@volter/twin-stripe 0.1.2 → 2.0.0

package/src/stripe-capabilities.ts

@@ -6,13 +6,16 @@
 // regression. Grow this toward Stripe's *full* surface every cycle — a missing entry is a
 // hidden gap, and a high % against a thin list is a misleading metric (the bug this fixes).
 import { mkdtempSync, rmSync } from 'node:fs';
-import { emitTwinEvent } from '@volter/twin';
+import { createServer } from 'node:http';
+import type { AddressInfo } from 'node:net';
+import { emitTwinEvent } from '@volter/world-core';
 import { stripeEmitter } from './stripe-emit.ts';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createElement } from 'react';
 import { renderToStaticMarkup } from 'react-dom/server';
-import { checkCapabilities, type CapabilityReport, type CapabilitySpec, verifyBoundary, isInfrastructureError, harnessError } from '@volter/twin-tooling';
+import { FORMAT_SCRIPT } from '@volter/world-ui';
+import { checkCapabilities, type CapabilityReport, type CapabilitySpec, verifyBoundary, isInfrastructureError, harnessError } from '@volter/world-tooling';
 import { ListPane, SECTIONS, PaymentErrorBanner, ConnectAccountPanel, BalanceSummary, type Section } from '../client/stripe-mirror.tsx';
 import type { StripeRow } from './stripe-mirror-ui.ts';
 import {
@@ -27,6 +30,12 @@ import {
 import { fullSyncStripe } from './stripe-connector.ts';
 import { buildStripeMirrorClient, createStripeMirrorServer, formatStripeAmount } from './stripe-mirror-ui.ts';
 import { handleStripeTwinRequest, type StripeResponse } from './stripe-twin.ts';
+import { createStripeTwinFetch } from './stripe-server.ts';
+import { pack } from './index.ts';
+import { stripeIdentityFlow } from './screens/identity.tsx';
+import { stripeFinancialConnectionsFlow } from './screens/financial-connections.tsx';
+import { currentlyDue, stripeOnboardingFlow } from './screens/onboarding.tsx';
+import { stripePortalFlow } from './screens/portal.tsx';
 
 // ── UI verify: the built mirror bundle must contain the screen's load-bearing markers ──
 let bundle: Promise<string> | null = null;
@@ -52,7 +61,7 @@ function uiDataCoupled(opts: {
     const js = await mirrorBundle();
     if (!opts.markers.every((m) => js.includes(m))) return false;
     const root = mkdtempSync(join(tmpdir(), 'stp-ui-'));
-    const server = createStripeMirrorServer({ root, port: 0 });
+    const server = await createStripeMirrorServer({ root, port: 0 });
     try {
       const h = (s: Step) => handleStripeTwinRequest({ method: s.m, path: s.p, body: s.b, root });
       await opts.seed(h);
@@ -95,17 +104,76 @@ type Step = { m: string; p: string; b?: string };
 type Body = Record<string, unknown>;
 
 /** Run a sequence of real Stripe requests against an isolated root; return all responses. */
-async function withRoot(steps: (h: (s: Step) => Promise<StripeResponse>) => Promise<boolean>): Promise<boolean> {
+async function withRoot(steps: (h: (s: Step) => Promise<StripeResponse>, root: string) => Promise<boolean>): Promise<boolean> {
   const root = mkdtempSync(join(tmpdir(), 'stp-cap-'));
   const h = (s: Step) => handleStripeTwinRequest({ method: s.m, path: s.p, body: s.b, root });
   try {
-    return await verifyBoundary('stripe.withRoot', () => steps(h));
+    return await verifyBoundary('stripe.withRoot', () => steps(h, root));
   } finally {
     rmSync(root, { recursive: true, force: true });
   }
 }
 
+/** Funds the Issuing balance with a top-up made a week before `at` (default now): a top-up "can take up to 5 business
+ *  days to become available. While they're pending, they won't be added to your Issuing balance"
+ *  (docs.stripe.com/issuing/funding/balance), so the next request at `at` finds it settled. */
+async function fundIssuing(root: string, amount: number, at?: string): Promise<StripeResponse> {
+  const t = at ? Date.parse(at) : Date.now();
+  return handleStripeTwinRequest({ method: 'POST', path: '/v1/topups', body: `amount=${amount}&currency=usd&destination_balance=issuing`, root, occurredAt: new Date(t - 7 * 86_400_000).toISOString() });
+}
+
 const ok = (r: StripeResponse) => r.status >= 200 && r.status < 300;
+/** A seller the platform can pay: a Custom account onboarded through the API (its business profile, the owner's
+ *  acceptance of the terms, a bank account), and funds in the platform's balance to send it. Answers the account id. */
+async function onboardedSeller(h: (s: Step) => Promise<StripeResponse>): Promise<string> {
+  const a = await h({ m: 'POST', p: '/v1/accounts', b: 'type=custom&country=US&capabilities[transfers][requested]=true&business_profile[mcc]=5462&business_profile[url]=https://seller.test&tos_acceptance[date]=1767225600&tos_acceptance[ip]=203.0.113.9' });
+  await h({ m: 'POST', p: `/v1/accounts/${id(a)}/external_accounts`, b: 'external_account[object]=bank_account&external_account[country]=US&external_account[currency]=usd&external_account[routing_number]=110000000&external_account[account_number]=000123456789' });
+  await h({ m: 'POST', p: '/v1/charges', b: 'amount=100000&currency=usd&source=tok_bypassPending' });
+  return id(a);
+}
+/** A local webhook receiver, as an application runs one: a node:http server on 127.0.0.1 that keeps each event POSTed
+ *  to it by path (`/platform`, `/connect`, …). */
+async function webhookReceiver(): Promise<{ url: (path: string) => string; got: (path: string) => StripeEvent[]; close: () => void }> {
+  const got = new Map<string, StripeEvent[]>();
+  const server = createServer((req, res) => {
+    let body = '';
+    req.on('data', (d) => { body += String(d); });
+    req.on('end', () => { got.set(String(req.url), [...(got.get(String(req.url)) ?? []), JSON.parse(body) as StripeEvent]); res.end('ok'); });
+  });
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const port = (server.address() as AddressInfo).port;
+  return { url: (path) => `http://127.0.0.1:${port}${path}`, got: (path) => got.get(path) ?? [], close: () => server.close() };
+}
+/** A request to the twin's fetch at a World instant, as an account (the Stripe-Account header) when one is named. */
+function fetcher(f: (r: Request) => Promise<Response>): (m: string, p: string, b?: string, acct?: string) => Promise<Body> {
+  return async (m, p, b, acct) => (await (await f(new Request(`http://stripe.test${p}`, {
+    method: m, headers: { authorization: 'Bearer sk_test_twin', 'content-type': 'application/x-www-form-urlencoded', ...(acct ? { 'stripe-account': acct } : {}) }, ...(b !== undefined ? { body: b } : {}),
+  }))).json()) as Body;
+}
+/** A dispute as Stripe opens one: a charge whose test card the bank disputes (docs.stripe.com/testing#disputes). */
+async function disputed(h: (s: Step) => Promise<StripeResponse>, amount = 1000): Promise<StripeResponse> {
+  await h({ m: 'POST', p: '/v1/charges', b: `amount=${amount}&currency=usd&source=tok_createDispute` });
+  const first = (((await h({ m: 'GET', p: '/v1/disputes' })).body as Body).data as Body[])[0]!;
+  return h({ m: 'GET', p: `/v1/disputes/${String(first.id)}` });
+}
+/** A field on a hosted page under the page's own formatting script: typing (one character at a time), deleting, or a
+ *  paste or autofill of a whole value, each answering the field's value after the script has run. */
+function expiryField(script: string): { type: (s: string) => string; back: () => string; fill: (s: string) => string } {
+  const listeners: Array<(e: { inputType: string }) => void> = [];
+  const el = { value: '', addEventListener: (_: string, f: (e: { inputType: string }) => void) => { listeners.push(f); } };
+  new Function('document', script)({ querySelectorAll: () => [el] });
+  const fire = (inputType: string) => { for (const f of listeners) f({ inputType }); return el.value; };
+  return {
+    type: (s) => { for (const c of s) { el.value += c; fire('insertText'); } return el.value; },
+    back: () => { el.value = el.value.slice(0, -1); return fire('deleteContentBackward'); },
+    fill: (s) => { el.value = s; return fire('insertFromPaste'); },
+  };
+}
+
+/** A person's submission on one of Stripe's hosted pages (verify.stripe.com, the bank-linking flow Stripe.js opens). */
+async function hostedSubmit(root: string, flow: (scope: { root?: string }) => (request: Request) => Promise<Response | undefined>, url: string, form: Record<string, string>): Promise<Response | undefined> {
+  return flow({ root })(new Request(url, { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams(form).toString() }));
+}
 const id = (r: StripeResponse) => (r.body as Body)?.id as string;
 const field = (r: StripeResponse, k: string) => (r.body as Body)?.[k];
 
@@ -119,7 +187,6 @@ const listOk = (path: string) => () =>
 // ── shorthands (mirror the linear manifest) ──
 const done = (id: string, area: string, title: string, dimension: CapabilitySpec['dimension'], tier: CapabilitySpec['tier'], verify: CapabilitySpec['verify']): CapabilitySpec => ({ id, area, title, dimension, tier, expected: 'done', verify });
 const todo = (id: string, area: string, title: string, dimension: CapabilitySpec['dimension'], tier: CapabilitySpec['tier']): CapabilitySpec => ({ id, area, title, dimension, tier, expected: 'todo' });
-const outOfScope = (id: string, area: string, title: string, dimension: CapabilitySpec['dimension'], tier: CapabilitySpec['tier'], reason: string): CapabilitySpec => ({ id, area, title, dimension, tier, expected: 'todo', outOfScope: reason });
 
 // The real Stripe surface (the target). Entries with verify() + expected:'done' are what we
 // currently claim are working against THIS twin; everything else (the majority) is a gap.
@@ -298,16 +365,25 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
     }),
   ),
   // Manual capture: a manual-capture PI confirmed lands in requires_capture (funds authorized,
-  // amount_capturable=amount), then /capture → succeeded (amount_received set, capturable cleared).
-  // Capturing an already-captured PI is the vendor 400 payment_intent_unexpected_state; unknown id 404.
+  // amount_capturable=amount) with its authorization a charge, succeeded and uncaptured (charge.succeeded), then
+  // /capture → succeeded (amount_received set, capturable cleared) capturing that same charge (charge.captured,
+  // "Occurs whenever a previously uncaptured charge is captured"). Capturing an already-captured PI is the vendor 400
+  // payment_intent_unexpected_state; unknown id 404.
   done('stripe.payment_intents.capture', 'payment_intents', 'PaymentIntent manual capture (capture_method=manual + /capture)', 'api', 'core', () =>
     withRoot(async (h) => {
       const pi = await h({ m: 'POST', p: '/v1/payment_intents', b: 'amount=2000&currency=usd&capture_method=manual' });
       if (!ok(pi)) return false;
       const conf = await h({ m: 'POST', p: `/v1/payment_intents/${id(pi)}/confirm`, b: 'payment_method=pm_card_visa' });
       if (!ok(conf) || field(conf, 'status') !== 'requires_capture' || field(conf, 'amount_capturable') !== 2000) return false;
+      const held = await h({ m: 'GET', p: `/v1/charges/${String(field(conf, 'latest_charge'))}` });
+      if (field(held, 'status') !== 'succeeded' || field(held, 'captured') !== false || field(held, 'amount_captured') !== 0 || field(held, 'balance_transaction') !== null) return false;
       const cap = await h({ m: 'POST', p: `/v1/payment_intents/${id(pi)}/capture` });
       if (!ok(cap) || field(cap, 'status') !== 'succeeded' || field(cap, 'amount_received') !== 2000 || field(cap, 'amount_capturable') !== 0) return false;
+      const taken = await h({ m: 'GET', p: `/v1/charges/${String(field(cap, 'latest_charge'))}` });
+      if (id(taken) !== id(held) || field(taken, 'captured') !== true || field(taken, 'amount_captured') !== 2000 || typeof field(taken, 'balance_transaction') !== 'string') return false;
+      const events = (((await h({ m: 'GET', p: '/v1/events?limit=100' })).body as Body).data as Body[]) ?? [];
+      const on = (type: string) => events.filter((e) => e.type === type && ((e.data as Body).object as Body).id === id(held)).map((e) => (e.data as Body).object as Body);
+      if (on('charge.succeeded').length !== 1 || on('charge.succeeded')[0]!.captured !== false || on('charge.captured').length !== 1 || on('charge.captured')[0]!.captured !== true) return false;
       // re-read persists; double-capture is the vendor unexpected-state 400; unknown id 404
       const g = await h({ m: 'GET', p: `/v1/payment_intents/${id(pi)}` });
       const again = await h({ m: 'POST', p: `/v1/payment_intents/${id(pi)}/capture` });
@@ -317,6 +393,51 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
         missing.status === 404;
     }),
   ),
+  // A declined confirm records the attempt as a failed charge the intent's latest_charge names, written as the event
+  // Stripe sends, charge.failed ("Occurs whenever a failed charge attempt occurs", docs.stripe.com/api/events/types), and
+  // carrying what every charge of the intent carries: its transfer_group and description. Dub reads the payout invoice a
+  // failed payment belongs to from transfer_group.
+  done('stripe.payment_intents.declined_charge', 'payment_intents', 'A declined confirm\'s failed charge fires charge.failed with the intent\'s transfer_group and description', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const pi = await h({ m: 'POST', p: '/v1/payment_intents', b: 'amount=2000&currency=usd&transfer_group=inv_77&description=Payout%20invoice%2077' });
+      const dec = await h({ m: 'POST', p: `/v1/payment_intents/${id(pi)}/confirm`, b: 'payment_method=pm_card_chargeDeclined' });
+      const chargeId = ((dec.body as Body).error as Body | undefined)?.charge;
+      const after = await h({ m: 'GET', p: `/v1/payment_intents/${id(pi)}` });
+      const charge = await h({ m: 'GET', p: `/v1/charges/${String(chargeId)}` });
+      const events = (((await h({ m: 'GET', p: '/v1/events?type=charge.failed' })).body as Body).data as Body[]) ?? [];
+      const object = (events[0]?.data as Body | undefined)?.object as Body | undefined;
+      return dec.status === 402 && field(after, 'latest_charge') === chargeId && field(charge, 'status') === 'failed'
+        && field(charge, 'transfer_group') === 'inv_77' && field(charge, 'description') === 'Payout invoice 77'
+        && events.length === 1 && object?.id === chargeId && object?.transfer_group === 'inv_77' && object?.description === 'Payout invoice 77';
+    }),
+  ),
+  // Cancelling a manual-capture intent releases its authorization: "For PaymentIntents with a `status` of
+  // `requires_capture`, the remaining `amount_capturable` is automatically refunded" (docs.stripe.com/api/payment_intents/cancel).
+  // Since basil the cancellation makes no Refund ("`refunded` will no longer be `true` for payment cancellation flows",
+  // the basil changelog), no money moves, and capturing the charge is refused, the intent being canceled.
+  done('stripe.payment_intents.cancel_authorization', 'payment_intents', 'Cancelling a requires_capture intent releases its uncaptured charge (no Refund, no balance moved); capturing it is refused', 'api', 'common', () =>
+    withRoot(async (h) => {
+      // the whole balance, available and pending
+      const avail = async (): Promise<number> => {
+        const b = (await h({ m: 'GET', p: '/v1/balance' })).body as Body;
+        return [...((b.available as Body[]) ?? []), ...((b.pending as Body[]) ?? [])].reduce((n, x) => n + (Number(x.amount) || 0), 0);
+      };
+      const pi = await h({ m: 'POST', p: '/v1/payment_intents', b: 'amount=2000&currency=usd&capture_method=manual&payment_method=pm_card_visa&confirm=true' });
+      const chargeId = String(field(pi, 'latest_charge'));
+      const before = await avail();
+      const cancel = await h({ m: 'POST', p: `/v1/payment_intents/${id(pi)}/cancel` });
+      const ch = await h({ m: 'GET', p: `/v1/charges/${chargeId}` });
+      const refunds = ((field(ch, 'refunds') as Body)?.data as Body[]) ?? [];
+      const capture = await h({ m: 'POST', p: `/v1/charges/${chargeId}/capture` });
+      const after = await avail();
+      // since basil a cancellation makes no Refund: amount_captured 0, amount_refunded and refunded untouched
+      return field(cancel, 'status') === 'canceled' && field(cancel, 'amount_capturable') === 0
+        && field(ch, 'captured') === false && field(ch, 'refunded') === false && field(ch, 'amount_refunded') === 0 && field(ch, 'amount_captured') === 0
+        && refunds.length === 0
+        && capture.status === 400 && ((capture.body as Body).error as Body)?.code === 'payment_intent_unexpected_state'
+        && before === 0 && after === 0;
+    }),
+  ),
   // Cancel: a non-terminal PI cancels → status canceled (+ cancellation_reason). Canceling a
   // succeeded PI is the vendor 400 payment_intent_unexpected_state; an unknown id is 404.
   done('stripe.payment_intents.cancel', 'payment_intents', 'PaymentIntent cancel', 'api', 'core', () =>
@@ -402,7 +523,7 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       return ok(g) && id(g) === id(ch) && field(l, 'object') === 'list';
     }),
   ),
-  done('stripe.charges.test_declines', 'charges', 'Test-card declines → 402 typed card_error (no charge persisted)', 'api', 'core', () =>
+  done('stripe.charges.test_declines', 'charges', 'Test-card declines → 402 typed card_error naming the failed charge', 'api', 'core', () =>
     withRoot(async (h) => {
       const dec = await h({ m: 'POST', p: '/v1/charges', b: 'amount=1000&currency=usd&source[number]=4000000000000002' });
       const ins = await h({ m: 'POST', p: '/v1/charges', b: 'amount=1000&currency=usd&source[number]=4000000000009995' });
@@ -411,6 +532,26 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       return dec.status === 402 && decErr?.code === 'card_declined' && ins.status === 402 && insErr?.decline_code === 'insufficient_funds';
     }),
   ),
+  // POST /v1/charges writes the event Stripe sends for the charge (docs.stripe.com/api/events/types; Stripe has no
+  // charge.created): charge.succeeded, "Occurs whenever a charge is successful", for one made and for an authorization
+  // (capture=false), charge.failed, "Occurs whenever a failed charge attempt occurs", for a declined attempt, and
+  // charge.captured, "Occurs whenever a previously uncaptured charge is captured", when the authorization is captured.
+  done('stripe.charges.events', 'charges', 'Charges fire charge.succeeded (made or authorized), charge.failed (declined) and charge.captured', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const made = await h({ m: 'POST', p: '/v1/charges', b: 'amount=2000&currency=usd&source=tok_visa' });
+      const auth = await h({ m: 'POST', p: '/v1/charges', b: 'amount=3000&currency=usd&source=tok_visa&capture=false' });
+      const dec = await h({ m: 'POST', p: '/v1/charges', b: 'amount=1000&currency=usd&source=tok_chargeDeclined' });
+      const declined = ((dec.body as Body).error as Body | undefined)?.charge;
+      await h({ m: 'POST', p: `/v1/charges/${id(auth)}/capture` });
+      const events = (((await h({ m: 'GET', p: '/v1/events?limit=100' })).body as Body).data as Body[]) ?? [];
+      const of = (type: string) => events.filter((e) => e.type === type).map((e) => (e.data as Body).object as Body);
+      const succeeded = of('charge.succeeded');
+      return dec.status === 402 && typeof declined === 'string'
+        && succeeded.some((c) => c.id === id(made) && c.captured === true) && succeeded.some((c) => c.id === id(auth) && c.captured === false)
+        && of('charge.failed').some((c) => c.id === declined && c.status === 'failed')
+        && of('charge.captured').some((c) => c.id === id(auth) && c.captured === true && c.amount_captured === 3000);
+    }),
+  ),
   // Charge capture: a charge created with capture=false is an uncaptured auth (captured:false,
   // amount_captured:0); /capture captures it (captured:true, amount_captured set). Re-capture
   // is the vendor 400 charge_already_captured; an immediately-captured charge (default) cannot
@@ -422,6 +563,12 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       const cap = await h({ m: 'POST', p: `/v1/charges/${id(auth)}/capture` });
       if (!ok(cap) || field(cap, 'captured') !== true || field(cap, 'amount_captured') !== 3000) return false;
       const again = await h({ m: 'POST', p: `/v1/charges/${id(auth)}/capture` });
+      // A PARTIAL capture releases the remainder with no Refund (the basil change): amount_refunded stays 0
+      const part = await h({ m: 'POST', p: '/v1/charges', b: 'amount=3000&currency=usd&capture=false' });
+      const capPart = await h({ m: 'POST', p: `/v1/charges/${id(part)}/capture`, b: 'amount=1200' });
+      if (!ok(capPart) || field(capPart, 'amount_captured') !== 1200 || field(capPart, 'amount_refunded') !== 0 || field(capPart, 'refunded') !== false) return false;
+      const released = ((field(capPart, 'refunds') as Body)?.data as Body[]) ?? [];
+      if (released.length !== 0) return false;
       const def = await h({ m: 'POST', p: '/v1/charges', b: 'amount=1000&currency=usd' });
       const capDef = await h({ m: 'POST', p: `/v1/charges/${id(def)}/capture` });
       const missing = await h({ m: 'POST', p: '/v1/charges/ch_nope/capture' });
@@ -464,30 +611,108 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
   // ── Refunds ─────────────────────────────────────────────────────────────────────
   done('stripe.refunds.crud', 'refunds', 'Refunds: create + retrieve + list', 'api', 'core', () =>
     withRoot(async (h) => {
-      const r = await h({ m: 'POST', p: '/v1/refunds', b: 'charge=ch_twin&amount=500' });
+      const c = await h({ m: 'POST', p: '/v1/charges', b: 'amount=2000&currency=usd' });
+      const r = await h({ m: 'POST', p: '/v1/refunds', b: `charge=${id(c)}&amount=500` });
       if (!ok(r) || field(r, 'object') !== 'refund') return false;
       const g = await h({ m: 'GET', p: `/v1/refunds/${id(r)}` });
       const l = await h({ m: 'GET', p: '/v1/refunds' });
       return ok(g) && id(g) === id(r) && field(l, 'object') === 'list';
     }),
   ),
+  // The money model's central claim: a refund is VISIBLE FROM THE CHARGE it came out of.
+  // amount_refunded accumulates, `refunded` flips only at the full amount, and the charge's
+  // own refunds sub-list carries the refund objects. A twin that answers a succeeded refund
+  // while the charge still reads amount_refunded 0 hands a reconciler the wrong ledger with
+  // no error to tell them — which is why the over-refund refusal is part of the same claim.
+  done('stripe.refunds.visible_on_charge', 'refunds', 'A refund lands on its charge: amount_refunded / refunded / refunds list, and an over-refund is refused', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const c = await h({ m: 'POST', p: '/v1/charges', b: 'amount=2000&currency=usd' });
+      const r1 = await h({ m: 'POST', p: '/v1/refunds', b: `charge=${id(c)}&amount=500` });
+      if (!ok(r1)) return false;
+      const partial = await h({ m: 'GET', p: `/v1/charges/${id(c)}` });
+      if (field(partial, 'amount_refunded') !== 500 || field(partial, 'refunded') !== false) return false;
+      const listed = (field(partial, 'refunds') as Body)?.data as Body[] | undefined;
+      if (!Array.isArray(listed) || listed.length !== 1 || listed[0]?.id !== id(r1)) return false;
+      // more than the charge has left to give is refused, not silently accepted
+      const tooMuch = await h({ m: 'POST', p: '/v1/refunds', b: `charge=${id(c)}&amount=1600` });
+      if (tooMuch.status !== 400) return false;
+      // an omitted amount refunds the whole remainder, and THEN the charge is fully refunded
+      // (taken through the charge's OWN refund endpoint — Stripe serves both spellings)
+      const r2 = await h({ m: 'POST', p: `/v1/charges/${id(c)}/refunds` });
+      if (!ok(r2) || field(r2, 'amount') !== 1500) return false;
+      const full = await h({ m: 'GET', p: `/v1/charges/${id(c)}` });
+      // and the charge's own refunds sub-route answers the same two refunds
+      const sub = await h({ m: 'GET', p: `/v1/charges/${id(c)}/refunds` });
+      const none = await h({ m: 'POST', p: '/v1/refunds', b: 'amount=100' });
+      const nosuch = await h({ m: 'POST', p: '/v1/refunds', b: 'charge=ch_nope&amount=100' });
+      return field(full, 'amount_refunded') === 2000 && field(full, 'refunded') === true
+        && ((field(sub, 'data') as Body[])?.length === 2)
+        && none.status === 400 && nosuch.status === 404;
+    }),
+  ),
+  // A refund reached through its PaymentIntent lands on the SAME charge: a succeeded intent
+  // has a latest_charge (real Stripe always mints one), and that is what the refund hits.
+  done('stripe.refunds.by_payment_intent', 'refunds', 'Refund by payment_intent resolves the intent’s charge', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const pi = await h({ m: 'POST', p: '/v1/payment_intents', b: 'amount=3000&currency=usd' });
+      const con = await h({ m: 'POST', p: `/v1/payment_intents/${id(pi)}/confirm`, b: 'payment_method=pm_card_visa' });
+      const charge = field(con, 'latest_charge') as string | undefined;
+      if (!charge) return false;
+      const r = await h({ m: 'POST', p: '/v1/refunds', b: `payment_intent=${id(pi)}&amount=1200` });
+      if (!ok(r) || field(r, 'charge') !== charge || field(r, 'payment_intent') !== id(pi)) return false;
+      const ch = await h({ m: 'GET', p: `/v1/charges/${charge}` });
+      const missing = await h({ m: 'POST', p: '/v1/refunds', b: 'payment_intent=pi_nope&amount=1' });
+      return field(ch, 'amount_refunded') === 1200 && missing.status === 404;
+    }),
+  ),
   // Refund update: POST /v1/refunds/:id persists metadata; retrieve round-trips it. Unknown id 404.
+  // An uncaptured charge holds an authorization, not money. A PaymentIntent's "remains uncaptured and can't be refunded
+  // directly. You must cancel the PaymentIntent" (docs.stripe.com/refunds), so its refund is refused, through the intent
+  // or the charge; a capture=false charge's refund releases it (refunded in full, no balance moved) and its capture is
+  // then refused ("unless the charge is already refunded", docs.stripe.com/api/charges/capture).
+  done('stripe.refunds.uncaptured', 'refunds', 'Refunding an uncaptured charge: refused for a PaymentIntent\'s (cancel it), a release for a capture=false charge; no balance moved, capture refused after', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const whole = async (): Promise<number> => {
+        const b = (await h({ m: 'GET', p: '/v1/balance' })).body as Body;
+        return [...((b.available as Body[]) ?? []), ...((b.pending as Body[]) ?? [])].reduce((n, x) => n + (Number(x.amount) || 0), 0);
+      };
+      const pi = await h({ m: 'POST', p: '/v1/payment_intents', b: 'amount=2000&currency=usd&capture_method=manual&payment_method=pm_card_visa&confirm=true' });
+      const viaIntent = await h({ m: 'POST', p: '/v1/refunds', b: `payment_intent=${id(pi)}` });
+      const viaCharge = await h({ m: 'POST', p: '/v1/refunds', b: `charge=${String(field(pi, 'latest_charge'))}` });
+      const still = await h({ m: 'GET', p: `/v1/charges/${String(field(pi, 'latest_charge'))}` });
+      if (viaIntent.status !== 400 || viaCharge.status !== 400 || field(still, 'refunded') !== false || field(still, 'amount_refunded') !== 0) return false;
+      const auth = await h({ m: 'POST', p: '/v1/charges', b: 'amount=3000&currency=usd&source=tok_visa&capture=false' });
+      const refund = await h({ m: 'POST', p: '/v1/refunds', b: `charge=${id(auth)}` });
+      const released = await h({ m: 'GET', p: `/v1/charges/${id(auth)}` });
+      const capture = await h({ m: 'POST', p: `/v1/charges/${id(auth)}/capture` });
+      return ok(refund) && field(refund, 'amount') === 3000 && field(refund, 'balance_transaction') === null
+        && field(released, 'refunded') === true && field(released, 'captured') === false && field(released, 'amount_refunded') === 3000
+        && capture.status === 400 && ((capture.body as Body).error as Body)?.code === 'charge_already_refunded' && await whole() === 0;
+    }),
+  ),
   done('stripe.refunds.update', 'refunds', 'Refund update (metadata)', 'api', 'common', () =>
     withRoot(async (h) => {
-      const r = await h({ m: 'POST', p: '/v1/refunds', b: 'charge=ch_twin&amount=500' });
+      const c = await h({ m: 'POST', p: '/v1/charges', b: 'amount=2000&currency=usd' });
+      const r = await h({ m: 'POST', p: '/v1/refunds', b: `charge=${id(c)}&amount=500` });
       const u = await h({ m: 'POST', p: `/v1/refunds/${id(r)}`, b: 'metadata[reason]=duplicate' });
       if (!ok(u) || ((field(u, 'metadata') as Body)?.reason) !== 'duplicate') return false;
       const g = await h({ m: 'GET', p: `/v1/refunds/${id(r)}` });
       const missing = await h({ m: 'POST', p: '/v1/refunds/re_nope', b: 'metadata[x]=1' });
-      return ok(g) && ((field(g, 'metadata') as Body)?.reason) === 'duplicate' && missing.status === 404;
+      // the same refund, read and written THROUGH its charge (Stripe's charge-scoped routes)
+      const viaCharge = await h({ m: 'GET', p: `/v1/charges/${id(c)}/refunds/${id(r)}` });
+      const editedViaCharge = await h({ m: 'POST', p: `/v1/charges/${id(c)}/refunds/${id(r)}`, b: 'metadata[note]=via-charge' });
+      const wrongCharge = await h({ m: 'GET', p: `/v1/charges/${id(c)}/refunds/re_nope` });
+      return ok(g) && ((field(g, 'metadata') as Body)?.reason) === 'duplicate' && missing.status === 404
+        && ok(viaCharge) && id(viaCharge) === id(r) && wrongCharge.status === 404
+        && ((field(editedViaCharge, 'metadata') as Body)?.note) === 'via-charge';
     }),
   ),
   // (refunds.cancel upgraded to done() in the AUDIT GROWTH block below.)
 
   // ── Disputes ────────────────────────────────────────────────────────────────────
-  done('stripe.disputes.crud', 'disputes', 'Disputes: create + retrieve + list', 'api', 'common', () =>
+  done('stripe.disputes.crud', 'disputes', 'Disputes: a disputed charge opens one; retrieve + list', 'api', 'common', () =>
     withRoot(async (h) => {
-      const d = await h({ m: 'POST', p: '/v1/disputes', b: 'charge=ch_twin&amount=1000&currency=usd' });
+      const d = await disputed(h);
       if (!ok(d) || field(d, 'object') !== 'dispute') return false;
       const g = await h({ m: 'GET', p: `/v1/disputes/${id(d)}` });
       const l = await h({ m: 'GET', p: '/v1/disputes' });
@@ -496,13 +721,27 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
   ),
   done('stripe.disputes.evidence', 'disputes', 'Dispute evidence submission (update) + close', 'api', 'common', () =>
     withRoot(async (h) => {
-      const d = await h({ m: 'POST', p: '/v1/disputes', b: 'charge=ch_twin&amount=1000&currency=usd' });
+      const d = await disputed(h);
       const ev = await h({ m: 'POST', p: `/v1/disputes/${id(d)}`, b: 'evidence[uncategorized_text]=we shipped it' });
       const cl = await h({ m: 'POST', p: `/v1/disputes/${id(d)}/close` });
       return ok(ev) && ok(cl) && field(cl, 'status') === 'lost';
     }),
   ),
 
+  // The dispute test cards open a dispute through Checkout as through the API, and test-mode evidence decides it:
+  // `winning_evidence` wins (the amount comes back), `losing_evidence` loses (docs.stripe.com/testing#disputes, #evidence).
+  done('stripe.disputes.test_outcomes', 'disputes', 'Dispute test cards through Checkout; winning_evidence / losing_evidence decide the dispute', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const cs = await h({ m: 'POST', p: '/v1/checkout/sessions', b: 'mode=payment&success_url=https://x.test&line_items[0][price_data][currency]=usd&line_items[0][price_data][unit_amount]=6500&line_items[0][quantity]=1' });
+      await h({ m: 'POST', p: `/c/pay/${id(cs)}`, b: 'email=pay%40twin.test&cardNumber=4000000000002685&cardExpiry=12%2F34&cardCvc=123&billingName=Twin&billingCountry=US&billingPostalCode=94105' });
+      const opened = ((await h({ m: 'GET', p: '/v1/disputes' })).body as Body).data as Body[];
+      const won = await h({ m: 'POST', p: `/v1/disputes/${String(opened[0]?.id)}`, b: 'evidence[uncategorized_text]=winning_evidence' });
+      const lostOne = await disputed(h);
+      const lost = await h({ m: 'POST', p: `/v1/disputes/${id(lostOne)}`, b: 'evidence[uncategorized_text]=losing_evidence' });
+      return opened[0]?.reason === 'product_not_received' && field(won, 'status') === 'won' && field(lost, 'status') === 'lost';
+    }),
+  ),
+
   // ── Balance / BalanceTransactions / Payouts ───────────────────────────────────────
   done('stripe.balance.retrieve', 'balance', 'Balance retrieve (available/pending)', 'api', 'core', () =>
     withRoot(async (h) => {
@@ -510,17 +749,37 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       return ok(r) && field(r, 'object') === 'balance';
     }),
   ),
-  done('stripe.balance_transactions.crud', 'balance', 'BalanceTransactions: create + retrieve + list', 'api', 'core', () =>
+  done('stripe.balance_transactions.crud', 'balance', 'BalanceTransactions: a charge\'s ledger entry; retrieve + list', 'api', 'core', () =>
     withRoot(async (h) => {
-      const t = await h({ m: 'POST', p: '/v1/balance_transactions', b: 'amount=1000&currency=usd' });
-      if (!ok(t)) return false;
+      await h({ m: 'POST', p: '/v1/charges', b: 'amount=1000&currency=usd&source=tok_visa' });
+      const t = { status: 200, body: (((await h({ m: 'GET', p: '/v1/balance_transactions' })).body as Body).data as Body[])[0]! } as StripeResponse;
+      if (!t.body || field(t, 'amount') !== 1000) return false;
       const g = await h({ m: 'GET', p: `/v1/balance_transactions/${id(t)}` });
       const l = await h({ m: 'GET', p: '/v1/balance_transactions' });
       return ok(g) && id(g) === id(t) && field(l, 'object') === 'list';
     }),
   ),
+  // Every money movement writes its balance transaction (semantics/ledger.ts): a captured charge credits its
+  // amount less Stripe's standard fee, pending until available_on; a refund and a payout debit at once; a
+  // platform payout beyond the available balance is balance_insufficient.
+  done('stripe.balance_transactions.from_money_movement', 'balance', 'BalanceTransactions written by charges, refunds and payouts; the balance their sum; payouts held to it', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const ch = await h({ m: 'POST', p: '/v1/charges', b: 'amount=10000&currency=usd&source=tok_visa' });
+      const btId = field(ch, 'balance_transaction') as string;
+      const bt = await h({ m: 'GET', p: `/v1/balance_transactions/${btId}` });
+      if (!(ok(bt) && field(bt, 'type') === 'charge' && field(bt, 'fee') === 320 && field(bt, 'net') === 9680 && field(bt, 'status') === 'pending')) return false;
+      // pending funds cannot be paid out; funds that settle at once can
+      if ((await h({ m: 'POST', p: '/v1/payouts', b: 'amount=5000&currency=usd' })).status !== 400) return false;
+      await h({ m: 'POST', p: '/v1/charges', b: 'amount=10000&currency=usd&source=tok_bypassPending' });
+      const po = await h({ m: 'POST', p: '/v1/payouts', b: 'amount=5000&currency=usd' });
+      const bal = await h({ m: 'GET', p: '/v1/balance' });
+      const available = ((bal.body as { available: Array<{ amount: number }> }).available[0]!).amount;
+      return ok(po) && available === 9680 - 5000;
+    }),
+  ),
   done('stripe.payouts.crud', 'payouts', 'Payouts: create + retrieve + list + cancel', 'api', 'core', () =>
     withRoot(async (h) => {
+      await h({ m: 'POST', p: '/v1/charges', b: 'amount=2000&currency=usd&source=tok_bypassPending' });
       const p = await h({ m: 'POST', p: '/v1/payouts', b: 'amount=1000&currency=usd' });
       if (!ok(p) || field(p, 'object') !== 'payout') return false;
       const g = await h({ m: 'GET', p: `/v1/payouts/${id(p)}` });
@@ -528,22 +787,33 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       return ok(g) && id(g) === id(p) && ok(c);
     }),
   ),
-  // Payout reverse: POST /v1/payouts/:id/reverse materializes the reversal as a NEW payout
-  // (carrying original_payout) and marks the original canceled + reversed_by. Reversing twice
-  // 400s; unknown id 404. (Only this feature sets original_payout / reversed_by.)
-  done('stripe.payouts.reverse', 'payouts', 'Payout reverse', 'api', 'niche', () =>
-    withRoot(async (h) => {
-      const p = await h({ m: 'POST', p: '/v1/payouts', b: 'amount=4000&currency=usd' });
-      if (!ok(p)) return false;
-      const rev = await h({ m: 'POST', p: `/v1/payouts/${id(p)}/reverse` });
+  // Payout reverse: a connected account's payout, once paid, is reversed as a NEW payout carrying original_payout;
+  // the original stays paid and names it (reversed_by). A pending payout is canceled instead (400), a platform payout
+  // cannot be reversed (400), reversing twice 400s, and an unknown id 404s.
+  done('stripe.payouts.reverse', 'payouts', 'Payout reverse (a connected account\'s paid payout)', 'api', 'niche', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'stp-rev-'));
+    try {
+      const h = (s: Step & { acct?: string; day?: number }) => handleStripeTwinRequest({ method: s.m, path: s.p, body: s.b, root, occurredAt: `2026-06-${String(s.day ?? 1).padStart(2, '0')}T00:00:00Z`, ...(s.acct ? { stripeAccount: s.acct } : {}) });
+      const seller = await onboardedSeller(h);
+      await h({ m: 'POST', p: '/v1/transfers', b: `amount=5000&currency=usd&destination=${seller}` });
+      const p = await h({ m: 'POST', p: '/v1/payouts', b: 'amount=4000&currency=usd', acct: seller });
+      if (!ok(p) || (await h({ m: 'POST', p: `/v1/payouts/${id(p)}/reverse`, acct: seller })).status !== 400) return false;
+      const rev = await h({ m: 'POST', p: `/v1/payouts/${id(p)}/reverse`, acct: seller, day: 5 });
       if (!ok(rev) || field(rev, 'original_payout') !== id(p) || field(rev, 'amount') !== 4000) return false;
-      const orig = await h({ m: 'GET', p: `/v1/payouts/${id(p)}` });
-      if (field(orig, 'status') !== 'canceled' || field(orig, 'reversed_by') !== id(rev)) return false;
-      const twice = await h({ m: 'POST', p: `/v1/payouts/${id(p)}/reverse` });
+      const orig = await h({ m: 'GET', p: `/v1/payouts/${id(p)}`, acct: seller, day: 5 });
+      if (field(orig, 'status') !== 'paid' || field(orig, 'reversed_by') !== id(rev)) return false;
+      const plat = await h({ m: 'POST', p: '/v1/payouts', b: 'amount=1000&currency=usd' });
+      const platRev = await h({ m: 'POST', p: `/v1/payouts/${id(plat)}/reverse`, day: 5 });
+      const twice = await h({ m: 'POST', p: `/v1/payouts/${id(p)}/reverse`, acct: seller, day: 5 });
       const nope = await h({ m: 'POST', p: '/v1/payouts/po_nope/reverse' });
-      return twice.status === 400 && nope.status === 404;
-    }),
-  ),
+      return platRev.status === 400 && twice.status === 400 && nope.status === 404;
+    } catch (err) {
+      if (isInfrastructureError(err)) throw harnessError('stripe.payouts.reverse', err);
+      return false;
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  }),
   // Payout schedule: the automatic-payout cadence lives in account.settings.payouts.schedule.
   // GET /v1/account returns the platform account with a default daily schedule; POST updates
   // it to e.g. weekly+anchor (anchors normalized — weekly_anchor set, monthly_anchor null) and
@@ -555,7 +825,7 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       if (!ok(acct)) return false;
       const sched0 = ((field(acct, 'settings') as Body)?.payouts as Body)?.schedule as Body;
       if (!sched0 || sched0.interval !== 'daily') return false;
-      const upd = await h({ m: 'POST', p: '/v1/account', b: 'settings[payouts][schedule][interval]=weekly&settings[payouts][schedule][weekly_anchor]=friday' });
+      const upd = await h({ m: 'POST', p: '/_twin/account', b: 'settings[payouts][schedule][interval]=weekly&settings[payouts][schedule][weekly_anchor]=friday' });
       const sched1 = ((field(upd, 'settings') as Body)?.payouts as Body)?.schedule as Body;
       if (!ok(upd) || sched1.interval !== 'weekly' || sched1.weekly_anchor !== 'friday' || sched1.monthly_anchor !== null) return false;
       // persists across a re-read.
@@ -569,6 +839,121 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
     }),
   ),
 
+  // Automatic payouts: on its schedule an account is paid out what has become available, and the ledger lists the
+  // entries each automatic payout paid (docs.stripe.com/payouts#payout-schedule,
+  // docs.stripe.com/api/balance_transactions/list#balance_transaction_list-payout).
+  done('stripe.payouts.automatic', 'payouts', 'Automatic payouts on the account\'s schedule, with the entries each paid out', 'api', 'core', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'stp-auto-'));
+    try {
+      const h = (s: Step & { day?: number }) => handleStripeTwinRequest({ method: s.m, path: s.p, body: s.b, root, occurredAt: `2026-06-${String(s.day ?? 1).padStart(2, '0')}T12:00:00Z` });
+      const ch = await h({ m: 'POST', p: '/v1/charges', b: 'amount=2000&currency=usd&source=tok_visa' });
+      const early = await h({ m: 'GET', p: '/v1/payouts', day: 2 });
+      const later = await h({ m: 'GET', p: '/v1/payouts?created[gte]=1780272000', day: 6 });
+      const po = (((later.body as Body).data as Body[]) ?? [])[0];
+      const entries = await h({ m: 'GET', p: `/v1/balance_transactions?payout=${String(po?.id)}`, day: 6 });
+      const sources = (((entries.body as Body).data as Body[]) ?? []).map((t) => t.source);
+      return ((early.body as Body).data as Body[]).length === 0 && po?.automatic === true && po.amount === 2000 - 88
+        && sources.includes(id(ch)) && sources.includes(po.id);
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  }),
+
+  // Time's events (stripe-server.ts, the drain door): funds coming due send their account balance.available, a payout's
+  // arrival sends payout.paid, each once, a connected account's scoped to it (docs.stripe.com/api/events/types;
+  // docs.stripe.com/connect/webhooks). Dub pays a partner's connected account out on balance.available and completes
+  // the partner's payouts on payout.paid. The webhooks are read where an application reads them, a local receiver behind
+  // a platform endpoint and a `connect` one; the stored events are listed as each account (the Stripe-Account header).
+  done('stripe.events.time_drain', 'webhooks', 'Events World time produces (balance.available, payout.paid) sent through the drain door, once each, scoped to their account', 'api', 'common', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'stp-drain-'));
+    const rx = await webhookReceiver();
+    try {
+      let now = '2026-06-01T12:00:00.000Z';
+      const h = fetcher(createStripeTwinFetch({ root, clock: () => now }));
+      await h('POST', '/v1/webhook_endpoints', `url=${rx.url('/platform')}&enabled_events[]=balance.available&enabled_events[]=payout.paid`);
+      await h('POST', '/v1/webhook_endpoints', `url=${rx.url('/connect')}&enabled_events[]=balance.available&enabled_events[]=payout.paid&connect=true`);
+      const seller = String((await h('POST', '/v1/accounts', 'type=custom&country=US&capabilities[transfers][requested]=true&business_profile[mcc]=5462&business_profile[url]=https://seller.test&tos_acceptance[date]=1767225600&tos_acceptance[ip]=203.0.113.9&settings[payouts][schedule][interval]=manual')).id);
+      await h('POST', `/v1/accounts/${seller}/external_accounts`, 'external_account[object]=bank_account&external_account[country]=US&external_account[currency]=usd&external_account[routing_number]=110000000&external_account[account_number]=000123456789');
+      await h('POST', '/_twin/account', 'settings[payouts][schedule][interval]=manual');
+      const pi = await h('POST', '/v1/payment_intents', 'amount=2592&currency=usd&payment_method=pm_card_visa&confirm=true');
+      await h('POST', '/v1/transfers', `amount=2400&currency=usd&destination=${seller}&source_transaction=${String(pi.latest_charge)}`);
+      const sent = async (): Promise<string[]> => ((await h('POST', '/_twin/drain')).delivered as Body[]).map((d) => `${String(d.type)}@${String(d.account ?? 'platform')}`);
+      const early = await sent();
+      now = '2026-06-04T12:00:00.000Z';
+      const due = await sent();
+      const again = await sent();
+      const po = await h('POST', '/v1/payouts', 'amount=2400&currency=usd', seller);
+      now = '2026-06-07T12:00:00.000Z';
+      const arrived = await sent();
+      // the connected account's webhooks reach only the connect endpoint, naming it; the platform's only the other
+      const theirs = rx.got('/connect');
+      const ours = rx.got('/platform');
+      const balance = theirs.find((e) => e.type === 'balance.available');
+      const paid = theirs.find((e) => e.type === 'payout.paid');
+      const hook = balance?.account === seller && ((balance.data.object as Body).available as Body[])?.[0]?.amount === 2400
+        && paid?.account === seller && (paid.data.object as Body).id === po.id && theirs.length === 2
+        && ours.length === 1 && ours[0]!.type === 'balance.available' && !('account' in ours[0]!);
+      const listed = (acct?: string) => h('GET', '/v1/events?limit=50', undefined, acct).then((l) => ((l.data as Body[]) ?? []).map((e) => `${String(e.type)}@${String(e.account ?? 'platform')}`));
+      const sellerEvents = await listed(seller);
+      const platformEvents = await listed();
+      return early.length === 0 && due.includes(`balance.available@${seller}`) && due.includes('balance.available@platform') && again.length === 0
+        && po.status === 'pending' && arrived.includes(`payout.paid@${seller}`) && hook
+        && sellerEvents.includes(`balance.available@${seller}`) && sellerEvents.includes(`payout.paid@${seller}`)
+        && platformEvents.includes('balance.available@platform') && !platformEvents.some((e) => e.endsWith(`@${seller}`));
+    } finally {
+      rx.close();
+      rmSync(root, { recursive: true, force: true });
+    }
+  }),
+
+  // One event, one id: the webhook a consumer receives and the event the Events API stores carry the same id, and no two
+  // events share one — Dub's queue deduplicates by event.id, and a Balance has no id of its own to tell two accounts'
+  // balance.available apart. Two partners' funds coming due in one drain are two events, each retrievable by its id as
+  // its account (the Stripe-Account header).
+  done('stripe.events.ids', 'webhooks', 'Event ids: unique per event (two accounts\' balance.available in one drain), and a webhook\'s id is the stored event\'s', 'api', 'common', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'stp-evid-'));
+    const rx = await webhookReceiver();
+    try {
+      let now = '2026-06-01T12:00:00.000Z';
+      const h = fetcher(createStripeTwinFetch({ root, clock: () => now }));
+      await h('POST', '/v1/webhook_endpoints', `url=${rx.url('/platform')}&enabled_events[]=*`);
+      await h('POST', '/v1/webhook_endpoints', `url=${rx.url('/connect')}&enabled_events[]=balance.available&connect=true`);
+      await h('POST', '/_twin/account', 'settings[payouts][schedule][interval]=manual');
+      const partner = async (): Promise<string> => {
+        const a = String((await h('POST', '/v1/accounts', 'type=custom&country=US&capabilities[transfers][requested]=true&business_profile[mcc]=5462&business_profile[url]=https://seller.test&tos_acceptance[date]=1767225600&tos_acceptance[ip]=203.0.113.9&settings[payouts][schedule][interval]=manual')).id);
+        await h('POST', `/v1/accounts/${a}/external_accounts`, 'external_account[object]=bank_account&external_account[country]=US&external_account[currency]=usd&external_account[routing_number]=110000000&external_account[account_number]=000123456789');
+        const pi = await h('POST', '/v1/payment_intents', 'amount=2000&currency=usd&payment_method=pm_card_visa&confirm=true');
+        await h('POST', '/v1/transfers', `amount=1500&currency=usd&destination=${a}&source_transaction=${String(pi.latest_charge)}`);
+        return a;
+      };
+      const [first, second] = [await partner(), await partner()];
+      const customer = await h('POST', '/v1/customers', 'email=ids@twin.test');
+      // two writes at once: each event takes its own number, though both are delivered before either answers
+      const [c1, c2] = await Promise.all([h('POST', '/v1/customers', 'email=ids1@twin.test'), h('POST', '/v1/customers', 'email=ids2@twin.test')]);
+      now = '2026-06-04T12:00:00.000Z';
+      await h('POST', '/_twin/drain');
+      const due = rx.got('/connect').filter((e) => e.type === 'balance.available');
+      const of = (acct: string) => due.find((e) => e.account === acct);
+      const [a, b] = [of(first), of(second)];
+      if (!a || !b || a.id === b.id || due.length !== 2) return false;
+      const [ga, gb] = [await h('GET', `/v1/events/${a.id}`, undefined, first), await h('GET', `/v1/events/${b.id}`, undefined, second)];
+      const hook = rx.got('/platform').find((e) => e.type === 'customer.created');
+      const stored = await h('GET', `/v1/events/${String(hook?.id)}`);
+      const ids = rx.got('/platform').concat(rx.got('/connect')).map((e) => e.id);
+      return ga.id === a.id && ga.account === first && ga.type === 'balance.available' && gb.id === b.id && gb.account === second
+        && stored.id === hook?.id && ((stored.data as Body)?.object as Body)?.id === customer.id && new Set(ids).size === ids.length
+        && await (async () => {
+          const both = rx.got('/platform').filter((e) => e.type === 'customer.created' && [c1.id, c2.id].includes(((e.data as Body)?.object as Body)?.id));
+          const looked = await Promise.all(both.map((e) => h('GET', `/v1/events/${String(e.id)}`)));
+          return both.length === 2 && both[0]!.id !== both[1]!.id
+            && looked.every((g, i) => ((g.data as Body)?.object as Body)?.id === ((both[i]!.data as Body)?.object as Body)?.id);
+        })();
+    } finally {
+      rx.close();
+      rmSync(root, { recursive: true, force: true });
+    }
+  }),
+
   // ── Products / Prices ─────────────────────────────────────────────────────────────
   done('stripe.products.crud', 'catalog', 'Products: create + retrieve + update + list', 'api', 'core', () =>
     withRoot(async (h) => {
@@ -592,6 +977,53 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       return ok(g) && field(l, 'object') === 'list' && bad.status >= 400;
     }),
   ),
+  // Plans: the Prices API "replaces the Plans API and is backwards compatible" (docs.stripe.com/api/plans/create), so a
+  // plan made with the id its creator chose ("You can optionally override this ID") is a recurring price under that id:
+  // read as a price, found by a lookup_key set on the price, and listed, updated and deleted as a plan. "Only one of
+  // `amount` and `amount_decimal` can be set"; plan writes send plan.created / plan.updated / plan.deleted carrying the
+  // plan; and "Existing subscribers aren't affected" by a deletion (docs.stripe.com/api/plans/delete).
+  done('stripe.plans.crud', 'catalog', 'Plans: create (with a chosen id) + retrieve + list + update + delete, each plan the recurring price it is', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const prod = await h({ m: 'POST', p: '/v1/products', b: 'name=Business' });
+      const plan = await h({ m: 'POST', p: '/v1/plans', b: `id=price_business_monthly&amount=9000&currency=usd&interval=month&product=${id(prod)}` });
+      if (!ok(plan) || field(plan, 'object') !== 'plan' || id(plan) !== 'price_business_monthly' || field(plan, 'amount') !== 9000) return false;
+      const asPrice = await h({ m: 'GET', p: '/v1/prices/price_business_monthly' });
+      const keyed = await h({ m: 'POST', p: '/v1/prices/price_business_monthly', b: 'lookup_key=business_monthly' });
+      const found = await h({ m: 'GET', p: '/v1/prices?lookup_keys[]=business_monthly' });
+      const again = await h({ m: 'POST', p: '/v1/plans', b: `id=price_business_monthly&amount=1&currency=usd&interval=month&product=${id(prod)}` });
+      const renamed = await h({ m: 'POST', p: '/v1/plans/price_business_monthly', b: 'nickname=Business%20monthly' });
+      const listed = await h({ m: 'GET', p: '/v1/plans' });
+      // a subscriber on the plan is not affected by its deletion: the price its item names stays, inactive
+      const cust = await h({ m: 'POST', p: '/v1/customers', b: 'email=plan@twin.test' });
+      const sub = await h({ m: 'POST', p: '/v1/subscriptions', b: `customer=${id(cust)}&items[0][price]=price_business_monthly&payment_behavior=default_incomplete` });
+      const gone = await h({ m: 'DELETE', p: '/v1/plans/price_business_monthly' });
+      const after = await h({ m: 'GET', p: '/v1/plans/price_business_monthly' });
+      const twice = await h({ m: 'DELETE', p: '/v1/plans/price_business_monthly' });
+      const kept = await h({ m: 'GET', p: '/v1/prices/price_business_monthly' });
+      const subAfter = await h({ m: 'GET', p: `/v1/subscriptions/${id(sub)}` });
+      const item = ((field(subAfter, 'items') as Body)?.data as Body[] | undefined)?.[0];
+      // amount_decimal is kept as the decimal given, and only one of amount and amount_decimal may be set
+      const decimal = await h({ m: 'POST', p: '/v1/plans', b: `amount_decimal=1250.5&currency=usd&interval=month&product=${id(prod)}` });
+      const both = await h({ m: 'POST', p: '/v1/plans', b: `amount=100&amount_decimal=100&currency=usd&interval=month&product=${id(prod)}` });
+      // a decimal plan bills the decimal times the quantity, rounded after multiplying (docs.stripe.com/products-prices/manage-prices): 1250.5 × 3 = 3751.5 → 3752
+      const onDecimal = await h({ m: 'POST', p: '/v1/subscriptions', b: `customer=${id(cust)}&items[0][price]=${id(decimal)}&items[0][quantity]=3&payment_behavior=default_incomplete` });
+      const decimalInvoice = await h({ m: 'GET', p: `/v1/invoices/${String(field(onDecimal, 'latest_invoice'))}` });
+      // plan writes send plan events carrying the plan
+      const events = (((await h({ m: 'GET', p: '/v1/events?limit=100' })).body as Body).data as Body[]) ?? [];
+      const planEvent = (type: string) => events.find((e) => e.type === type && ((e.data as Body).object as Body).id === 'price_business_monthly');
+      const sent = ['plan.created', 'plan.updated', 'plan.deleted'].every((t) => ((planEvent(t)?.data as Body | undefined)?.object as Body | undefined)?.object === 'plan')
+        && (((planEvent('plan.created')?.data as Body).object as Body).amount === 9000);
+      const data = (field(found, 'data') ?? []) as Array<{ id?: string }>;
+      return ok(asPrice) && field(asPrice, 'object') === 'price' && field(asPrice, 'unit_amount') === 9000
+        && ok(keyed) && data.length === 1 && data[0]!.id === 'price_business_monthly'
+        && again.status === 400
+        && field(renamed, 'nickname') === 'Business monthly'
+        && field(listed, 'object') === 'list' && ok(gone) && field(gone, 'deleted') === true && after.status === 404 && twice.status === 404
+        && ok(kept) && field(kept, 'active') === false && (item?.price as Body | undefined)?.id === 'price_business_monthly'
+        && ok(decimal) && field(decimal, 'amount_decimal') === '1250.5' && field(decimal, 'amount') === null
+        && both.status === 400 && sent && field(decimalInvoice, 'total') === 3752;
+    }),
+  ),
   // Tiered pricing: a billing_scheme=tiered price requires tiers_mode (graduated|volume) +
   // tiers[] (each up_to + unit_amount/flat_amount); the twin normalizes the tiers, forces
   // unit_amount null, and round-trips them. currency_options pass through (a per-currency
@@ -671,7 +1103,7 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
   done('stripe.promotion_codes.create', 'discounts', 'PromotionCode create + activate/deactivate', 'api', 'common', () =>
     withRoot(async (h) => {
       const coupon = await h({ m: 'POST', p: '/v1/coupons', b: 'percent_off=10&duration=once' });
-      const pc = await h({ m: 'POST', p: '/v1/promotion_codes', b: `coupon=${id(coupon)}&code=SAVE10` });
+      const pc = await h({ m: 'POST', p: '/v1/promotion_codes', b: `promotion[type]=coupon&promotion[coupon]=${id(coupon)}&code=SAVE10` });
       if (!ok(pc) || field(pc, 'object') !== 'promotion_code' || field(pc, 'code') !== 'SAVE10' || field(pc, 'active') !== true || field(pc, 'coupon') !== id(coupon)) return false;
       const g = await h({ m: 'GET', p: `/v1/promotion_codes/${id(pc)}` });
       const off = await h({ m: 'POST', p: `/v1/promotion_codes/${id(pc)}`, b: 'active=false' });
@@ -680,7 +1112,7 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       if (!ok(g) || id(g) !== id(pc) || !ok(off) || field(off, 'active') !== false || !ok(on) || field(on, 'active') !== true) return false;
       if (((lst.body as Body).data as Body[]).length !== 1) return false;
       const noCoupon = await h({ m: 'POST', p: '/v1/promotion_codes', b: 'code=X' });
-      const badCoupon = await h({ m: 'POST', p: '/v1/promotion_codes', b: 'coupon=coupon_nope&code=Y' });
+      const badCoupon = await h({ m: 'POST', p: '/v1/promotion_codes', b: 'promotion[type]=coupon&promotion[coupon]=coupon_nope&code=Y' });
       return noCoupon.status === 400 && badCoupon.status === 400 && ((badCoupon.body as Body).error as Body)?.code === 'resource_missing';
     }),
   ),
@@ -707,7 +1139,7 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       if (!card || card.last4 !== '4242') return false;
       // last4 FIDELITY (not just presence): a raw test PAN must surface its TRUE last4 —
       // the '4242' check above can't prove that, since '4242' equals the synthesized
-      // fallback. parseStripeForm coerces an all-digit card[number] to a JS number (like
+      // fallback. The form reader coerces an all-digit card[number] to a JS number (like
       // any numeric-looking form field), so cover BOTH wire shapes: the numeric-coerced
       // bare PAN and a string PAN (spaces keep it a string through the form parser).
       const pmNum = await h({ m: 'POST', p: '/v1/payment_methods', b: 'type=card&card[number]=5555555555554444&card[exp_month]=4&card[exp_year]=2030&card[cvc]=314' });
@@ -785,13 +1217,54 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       const cust = await h({ m: 'POST', p: '/v1/customers', b: 'email=sub@twin.test' });
       const prod = await h({ m: 'POST', p: '/v1/products', b: 'name=Plan' });
       const price = await h({ m: 'POST', p: '/v1/prices', b: `unit_amount=1500&currency=usd&recurring[interval]=month&product=${id(prod)}` });
-      const sub = await h({ m: 'POST', p: '/v1/subscriptions', b: `customer=${id(cust)}&items[0][price]=${id(price)}` });
+      // the customer's card pays the first invoice, so the subscription starts active
+      const card = await h({ m: 'POST', p: '/v1/payment_methods/pm_card_visa/attach', b: `customer=${id(cust)}` });
+      const sub = await h({ m: 'POST', p: '/v1/subscriptions', b: `customer=${id(cust)}&items[0][price]=${id(price)}&default_payment_method=${id(card)}` });
       if (!ok(sub) || field(sub, 'status') !== 'active') return false;
       const g = await h({ m: 'GET', p: `/v1/subscriptions/${id(sub)}` });
       const cancel = await h({ m: 'DELETE', p: `/v1/subscriptions/${id(sub)}` });
       return ok(g) && ok(cancel) && field(cancel, 'status') === 'canceled';
     }),
   ),
+  // An update's `items` changes the subscription's items (docs.stripe.com/api/subscriptions/update): an entry with an
+  // `id` swaps that item's price ("`quantity` is set to 1 unless a `quantity` parameter is provided") or its quantity, or
+  // with `deleted` removes it; one without adds an item, from a price or from `price_data`, which generates a Price
+  // inline, archived (active=false; docs.stripe.com/products-prices/manage-prices). A refused entry refuses the whole
+  // update, leaving the items as they were. Dub's trial switch to Advanced replaced the price of its one item.
+  done('stripe.subscriptions.update_items', 'subscriptions', 'Subscription update items: swap a price, change a quantity, add (price or price_data), delete; all or nothing', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const cust = await h({ m: 'POST', p: '/v1/customers', b: 'email=items@twin.test' });
+      const prod = await h({ m: 'POST', p: '/v1/products', b: 'name=Pro' });
+      const pro = await h({ m: 'POST', p: '/v1/prices', b: `unit_amount=1000&currency=usd&recurring[interval]=month&product=${id(prod)}` });
+      const advanced = await h({ m: 'POST', p: '/v1/prices', b: `unit_amount=3000&currency=usd&recurring[interval]=month&product=${id(prod)}` });
+      const sub = await h({ m: 'POST', p: '/v1/subscriptions', b: `customer=${id(cust)}&items[0][price]=${id(pro)}&items[0][quantity]=3&payment_behavior=default_incomplete` });
+      const items = (r: StripeResponse): Body[] => ((field(r, 'items') as Body)?.data as Body[]) ?? [];
+      const si = String(items(sub)[0]?.id);
+      const upd = (b: string) => h({ m: 'POST', p: `/v1/subscriptions/${id(sub)}`, b });
+      const swapped = await upd(`items[0][id]=${si}&items[0][price]=${id(advanced)}`);
+      const s0 = items(swapped);
+      if (s0.length !== 1 || s0[0]?.id !== si || (s0[0]?.price as Body)?.id !== id(advanced) || s0[0]?.quantity !== 1) return false;
+      const more = items(await upd(`items[0][id]=${si}&items[0][quantity]=5`));
+      if (more.length !== 1 || more[0]?.quantity !== 5 || (more[0]?.price as Body)?.id !== id(advanced)) return false;
+      // naming the item's own price is no change of price: the quantity stays
+      const same = items(await upd(`items[0][id]=${si}&items[0][price]=${id(advanced)}`));
+      if (same[0]?.quantity !== 5) return false;
+      const added = items(await upd(`items[0][price_data][currency]=usd&items[0][price_data][product]=${id(prod)}&items[0][price_data][unit_amount]=250&items[0][price_data][recurring][interval]=month`));
+      const inline = added.find((i) => i.id !== si)?.price as Body | undefined;
+      if (added.length !== 2 || inline?.unit_amount !== 250 || inline?.active !== false || inline?.product !== id(prod)) return false;
+      // one bad entry refuses the update: the delete beside it is not applied
+      const refused = await upd(`items[0][id]=${si}&items[0][deleted]=true&items[1][price]=price_nope`);
+      const kept = items(await h({ m: 'GET', p: `/v1/subscriptions/${id(sub)}` }));
+      if (refused.status !== 400 || kept.length !== 2 || !kept.some((i) => i.id === si)) return false;
+      const removed = items(await upd(`items[0][id]=${si}&items[0][deleted]=true`));
+      const listed = await h({ m: 'GET', p: `/v1/subscription_items?subscription=${id(sub)}` });
+      // a price_data amount that is not a whole number of cents is kept as the decimal, never truncated
+      const decimal = items(await upd(`items[0][price_data][currency]=usd&items[0][price_data][product]=${id(prod)}&items[0][price_data][unit_amount_decimal]=12.5&items[0][price_data][recurring][interval]=month`));
+      const decimalPrice = decimal.map((i) => i.price as Body).find((p) => p?.unit_amount_decimal === '12.5');
+      return removed.length === 1 && removed[0]?.id !== si && ((listed.body as Body).data as Body[]).length === 1
+        && decimalPrice !== undefined && decimalPrice.unit_amount === null;
+    }),
+  ),
   done('stripe.subscriptions.list', 'subscriptions', 'Subscription list + filter by customer', 'api', 'core', () =>
     withRoot(async (h) => {
       const r = await h({ m: 'GET', p: '/v1/subscriptions' });
@@ -810,13 +1283,207 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       const sub = await h({ m: 'POST', p: '/v1/subscriptions', b: `customer=${id(cust)}&items[0][price]=${id(price)}&trial_period_days=14` });
       if (!ok(sub) || field(sub, 'status') !== 'trialing' || typeof field(sub, 'trial_end') !== 'number') return false;
       // upcoming invoice WITH a proration_date splits the period (credit + charge proration lines).
-      const up = await h({ m: 'GET', p: `/v1/invoices/upcoming?subscription=${id(sub)}&proration_date=100` });
+      const up = await h({ m: 'POST', p: '/v1/invoices/create_preview', b: `subscription=${id(sub)}&subscription_details[proration_date]=100` });
       if (!ok(up) || field(up, 'object') !== 'invoice' || field(up, 'id') !== null) return false;
       const lines = (field(up, 'lines') as Body).data as Body[];
       const prorations = lines.filter((l) => l.proration === true);
       return prorations.length === 2 && prorations.some((l) => Number(l.amount) < 0) && prorations.some((l) => Number(l.amount) > 0);
     }),
   ),
+  // Renewal over time: at the period's end a subscription_cycle invoice is drafted and, an hour on, charged to the
+  // default payment method; a card that declines when charged leaves it open and the subscription past_due, and
+  // paying it makes the subscription active (docs.stripe.com/billing/subscriptions/overview#payment-status).
+  done('stripe.subscriptions.renewal', 'subscriptions', 'Subscriptions renew at each period end; a declined renewal is past_due until its invoice is paid', 'api', 'core', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'stp-renew-'));
+    try {
+      const h = (s: Step & { month?: number }) => handleStripeTwinRequest({ method: s.m, path: s.p, body: s.b, root, occurredAt: `2026-${String(s.month ?? 1).padStart(2, '0')}-10T00:00:00Z` });
+      const prod = await h({ m: 'POST', p: '/v1/products', b: 'name=Box' });
+      const price = await h({ m: 'POST', p: '/v1/prices', b: `unit_amount=3500&currency=usd&recurring[interval]=month&product=${id(prod)}` });
+      const payer = await h({ m: 'POST', p: '/v1/customers', b: 'email=renews@twin.test&payment_method=pm_card_visa&invoice_settings[default_payment_method]=pm_card_visa' });
+      const good = await h({ m: 'POST', p: '/v1/subscriptions', b: `customer=${id(payer)}&items[0][price]=${id(price)}&default_payment_method=pm_card_visa` });
+      const failing = await h({ m: 'POST', p: '/v1/customers', b: 'email=declines@twin.test' });
+      const bad = await h({ m: 'POST', p: '/v1/subscriptions', b: `customer=${id(failing)}&items[0][price]=${id(price)}&default_payment_method=pm_card_chargeCustomerFail&trial_period_days=7` });
+      const renewed = await h({ m: 'GET', p: `/v1/invoices?subscription=${id(good)}`, month: 2 });
+      const cycle = ((renewed.body as Body).data as Body[]).find((i) => i.billing_reason === 'subscription_cycle');
+      const pastDue = await h({ m: 'GET', p: `/v1/subscriptions/${id(bad)}`, month: 2 });
+      const open = (((await h({ m: 'GET', p: `/v1/invoices?subscription=${id(bad)}&status=open`, month: 2 })).body as Body).data as Body[])[0];
+      const paid = await h({ m: 'POST', p: `/v1/invoices/${String(open?.id)}/pay`, b: 'payment_method=pm_card_visa', month: 2 });
+      const back = await h({ m: 'GET', p: `/v1/subscriptions/${id(bad)}`, month: 2 });
+      // made when Stripe would have made it, not when the February request caught it up
+      const stamped = cycle?.created === cycle?.period_start && (cycle?.status_transitions as Body | undefined)?.paid_at === Number(cycle?.period_start) + 3600;
+      return stamped && cycle?.status === 'paid' && cycle.amount_paid === 3500 && field(pastDue, 'status') === 'past_due'
+        && open?.attempt_count === 1 && field(paid, 'status') === 'paid' && field(back, 'status') === 'active';
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  }),
+  // A `once` coupon discounts one invoice: the one the subscription finalizes next after it was applied, which records it,
+  // and is then removed from the subscription's discounts (docs.stripe.com/billing/subscriptions/coupons#coupon-duration),
+  // however that invoice is finalized: by time, or through the Invoices API.
+  done('stripe.subscriptions.once_coupon', 'subscriptions', 'A once coupon discounts the next invoice finalized after it is applied, then is removed from the subscription', 'api', 'common', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'stp-once-'));
+    try {
+      const h = (s: Step & { at?: string }) => handleStripeTwinRequest({ method: s.m, path: s.p, body: s.b, root, occurredAt: s.at ?? '2026-03-01T00:00:00Z' });
+      const prod = await h({ m: 'POST', p: '/v1/products', b: 'name=Box' });
+      const price = await h({ m: 'POST', p: '/v1/prices', b: `unit_amount=9000&currency=usd&recurring[interval]=month&product=${id(prod)}` });
+      const cust = await h({ m: 'POST', p: '/v1/customers', b: 'email=once%40twin.test&payment_method=pm_card_visa&invoice_settings[default_payment_method]=pm_card_visa' });
+      const coupon = await h({ m: 'POST', p: '/v1/coupons', b: 'id=HALF&percent_off=50&duration=once' });
+      const invoices = async (sub: StripeResponse, at: string) => ((((await h({ m: 'GET', p: `/v1/invoices?subscription=${id(sub)}`, at })).body as Body).data as Body[]) ?? []);
+      const discounts = (r: StripeResponse) => ((field(r, 'discounts') as unknown[] | undefined) ?? []).length;
+      // added after April's renewal was drafted (00:00) and before it is collected (01:00): April is full, May is halved
+      const late = await h({ m: 'POST', p: '/v1/subscriptions', b: `customer=${id(cust)}&items[0][price]=${id(price)}` });
+      await h({ m: 'GET', p: `/v1/subscriptions/${id(late)}`, at: '2026-04-01T00:10:00Z' });
+      await h({ m: 'POST', p: `/v1/subscriptions/${id(late)}`, b: `discounts[0][coupon]=${id(coupon)}`, at: '2026-04-01T00:20:00Z' });
+      const april = (await invoices(late, '2026-04-01T02:00:00Z')).find((i) => i.period_start === Date.parse('2026-04-01T00:00:00Z') / 1000);
+      const stillThere = await h({ m: 'GET', p: `/v1/subscriptions/${id(late)}`, at: '2026-04-01T02:00:00Z' });
+      const may = (await invoices(late, '2026-05-01T02:00:00Z')).find((i) => i.period_start === Date.parse('2026-05-01T00:00:00Z') / 1000);
+      const gone = await h({ m: 'GET', p: `/v1/subscriptions/${id(late)}`, at: '2026-05-01T02:00:00Z' });
+      if (april?.total !== 9000 || discounts(stillThere) !== 1 || may?.total !== 4500 || discounts(gone) !== 0) return false;
+      // the renewal's draft finalized and paid through the Invoices API spends it too: June is full again
+      const other = await h({ m: 'POST', p: '/v1/subscriptions', b: `customer=${id(cust)}&items[0][price]=${id(price)}` });
+      await h({ m: 'POST', p: `/v1/subscriptions/${id(other)}`, b: `discounts[0][coupon]=${id(coupon)}`, at: '2026-03-15T00:00:00Z' });
+      const draft = (await invoices(other, '2026-04-01T00:10:00Z')).find((i) => i.status === 'draft');
+      await h({ m: 'POST', p: `/v1/invoices/${String(draft?.id)}/finalize`, at: '2026-04-01T00:20:00Z' });
+      const afterFinalize = await h({ m: 'GET', p: `/v1/subscriptions/${id(other)}`, at: '2026-04-01T00:30:00Z' });
+      const mayOther = (await invoices(other, '2026-05-01T02:00:00Z')).find((i) => i.period_start === Date.parse('2026-05-01T00:00:00Z') / 1000);
+      return draft?.total === 4500 && discounts(afterFinalize) === 0 && mayOther?.total === 9000;
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  }),
+  // Ending a trial early: `trial_end=now` on a trialing subscription starts a paid period now, invoices it and charges it
+  // at once (active; a decline leaves it past_due, error_if_incomplete refuses with 402 and changes nothing); a future
+  // timestamp moves the trial's end and the period with it; a past one is refused (semantics/subscriptions.ts
+  // applyTrialEnd; docs.stripe.com/api/subscriptions/update#update_subscription-trial_end,
+  // docs.stripe.com/billing/subscriptions/upgrade-downgrade#immediate-payment). Read in basil's shape, as Dub reads it.
+  done('stripe.subscriptions.trial_end_now', 'subscriptions', 'Subscription update trial_end: `now` ends the trial and charges a new period at once; a timestamp moves it; a past one is refused', 'api', 'core', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'stp-trialend-'));
+    try {
+      const h = (s: Step & { day?: number }) => handleStripeTwinRequest({ method: s.m, path: s.p, body: s.b, root, occurredAt: `2026-03-${String(s.day ?? 1).padStart(2, '0')}T00:00:00Z` });
+      const day = (d: number) => Date.parse(`2026-03-${String(d).padStart(2, '0')}T00:00:00Z`) / 1000;
+      const prod = await h({ m: 'POST', p: '/v1/products', b: 'name=Business' });
+      const price = await h({ m: 'POST', p: '/v1/prices', b: `unit_amount=9000&currency=usd&recurring[interval]=month&product=${id(prod)}` });
+      const trialing = async (email: string, pm: string) => {
+        const c = await h({ m: 'POST', p: '/v1/customers', b: `email=${email}&payment_method=${pm}&invoice_settings[default_payment_method]=${pm}` });
+        return h({ m: 'POST', p: '/v1/subscriptions', b: `customer=${id(c)}&items[0][price]=${id(price)}&trial_period_days=14` });
+      };
+      const period = (r: StripeResponse) => ((field(r, 'items') as Body | undefined)?.data as Body[] | undefined)?.[0] ?? {};
+      const sub = await trialing('trial%40twin.test', 'pm_card_visa');
+      // a trial's end is its billing anchor
+      if (field(sub, 'billing_cycle_anchor') !== field(sub, 'trial_end')) return false;
+      // refused before anything changes: a past timestamp, a value that is no timestamp
+      const past = await h({ m: 'POST', p: `/v1/subscriptions/${id(sub)}`, b: 'trial_end=1700000000', day: 3 });
+      const junk = await h({ m: 'POST', p: `/v1/subscriptions/${id(sub)}`, b: 'trial_end=tomorrow', day: 3 });
+      const pastError = (past.body as { error?: Body }).error;
+      if (past.status !== 400 || pastError?.param !== 'trial_end' || pastError?.message !== 'Invalid timestamp: must be an integer Unix timestamp in the future.' || junk.status !== 400) return false;
+      // a future timestamp moves the trial's end, the period's end and the billing anchor
+      const moved = await h({ m: 'POST', p: `/v1/subscriptions/${id(sub)}`, b: `trial_end=${day(20)}`, day: 3 });
+      if (field(moved, 'status') !== 'trialing' || field(moved, 'trial_end') !== day(20) || period(moved).current_period_end !== day(20) || field(moved, 'billing_cycle_anchor') !== day(20)) return false;
+      // `now`: the trial ends, a month's period starts now and its invoice is paid by the default payment method
+      const ended = await h({ m: 'POST', p: `/v1/subscriptions/${id(sub)}`, b: 'trial_end=now&cancel_at_period_end=false', day: 5 });
+      const inv = await h({ m: 'GET', p: `/v1/invoices/${String(field(ended, 'latest_invoice'))}`, day: 5 });
+      const invoices = (((await h({ m: 'GET', p: `/v1/invoices?customer=${String(field(sub, 'customer'))}`, day: 5 })).body as Body).data as Body[]) ?? [];
+      const events = ((((await h({ m: 'GET', p: '/v1/events?limit=100', day: 5 })).body as Body).data as Body[]) ?? []).filter((e) => e.created === day(5)).map((e) => e.type);
+      const endedOk = ok(ended) && field(ended, 'status') === 'active' && field(ended, 'trial_end') === day(5) && field(ended, 'billing_cycle_anchor') === day(5)
+        && period(ended).current_period_start === day(5) && period(ended).current_period_end === Date.parse('2026-04-05T00:00:00Z') / 1000;
+      const invoiceOk = field(inv, 'status') === 'paid' && field(inv, 'billing_reason') === 'subscription_update' && field(inv, 'amount_paid') === 9000
+        && field(inv, 'period_start') === day(5) && invoices.some((i) => i.id === id(inv));
+      if (!endedOk || !invoiceOk || !['customer.subscription.updated', 'invoice.created', 'invoice.paid'].every((t) => events.includes(t))) return false;
+      // a cancel scheduled during the trial follows the new period; a `once` coupon added during the trial, or with the
+      // update itself, takes the invoice ending it and is then spent
+      const once = await h({ m: 'POST', p: '/v1/coupons', b: 'id=HALFOFF&percent_off=50&duration=once', day: 2 });
+      const leaving = await trialing('leaving%40twin.test', 'pm_card_visa');
+      await h({ m: 'POST', p: `/v1/subscriptions/${id(leaving)}`, b: `cancel_at_period_end=true&discounts[0][coupon]=${id(once)}`, day: 2 });
+      const early = await h({ m: 'POST', p: `/v1/subscriptions/${id(leaving)}`, b: 'trial_end=now', day: 5 });
+      const halved = await h({ m: 'GET', p: `/v1/invoices/${String(field(early, 'latest_invoice'))}`, day: 5 });
+      const sameCall = await trialing('same%40twin.test', 'pm_card_visa');
+      const withCoupon = await h({ m: 'POST', p: `/v1/subscriptions/${id(sameCall)}`, b: `trial_end=now&discounts[0][coupon]=${id(once)}`, day: 5 });
+      const halvedToo = await h({ m: 'GET', p: `/v1/invoices/${String(field(withCoupon, 'latest_invoice'))}`, day: 5 });
+      const spent = (r: StripeResponse) => ((field(r, 'discounts') as Body[] | undefined) ?? []).length === 0;
+      if (field(early, 'cancel_at') !== period(early).current_period_end || field(early, 'cancel_at_period_end') !== true || field(halved, 'total') !== 4500
+        || !spent(early) || field(halvedToo, 'total') !== 4500 || !spent(withCoupon)) return false;
+      // what the update leaves bills: a quantity of 0 bills nothing (paid, active, with no card); an unknown item is refused as such
+      const nobody = await h({ m: 'POST', p: '/v1/customers', b: 'email=nobody%40twin.test' });
+      const idle = await h({ m: 'POST', p: '/v1/subscriptions', b: `customer=${id(nobody)}&items[0][price]=${id(price)}&trial_period_days=14` });
+      const zero = await h({ m: 'POST', p: `/v1/subscriptions/${id(idle)}`, b: `trial_end=now&payment_behavior=error_if_incomplete&items[0][id]=${String(period(idle).id)}&items[0][quantity]=0`, day: 5 });
+      const zeroInvoice = await h({ m: 'GET', p: `/v1/invoices/${String(field(zero, 'latest_invoice'))}`, day: 5 });
+      if (field(zero, 'status') !== 'active' || field(zeroInvoice, 'total') !== 0 || field(zeroInvoice, 'status') !== 'paid') return false;
+      const idle2 = await h({ m: 'POST', p: '/v1/subscriptions', b: `customer=${id(nobody)}&items[0][price]=${id(price)}&trial_period_days=14` });
+      const decimal = await h({ m: 'POST', p: `/v1/subscriptions/${id(idle2)}`, b: `trial_end=now&payment_behavior=error_if_incomplete&items[0][id]=${String(period(idle2).id)}&items[0][deleted]=true&items[1][price_data][currency]=usd&items[1][price_data][product]=${id(prod)}&items[1][price_data][unit_amount_decimal]=5000&items[1][price_data][recurring][interval]=month`, day: 5 });
+      const unknown = await h({ m: 'POST', p: `/v1/subscriptions/${id(idle2)}`, b: 'trial_end=now&payment_behavior=error_if_incomplete&items[0][id]=si_nope&items[0][quantity]=2', day: 5 });
+      const idleAfter = await h({ m: 'GET', p: `/v1/subscriptions/${id(idle2)}`, day: 5 });
+      if (decimal.status !== 400 || !String(((unknown.body as { error?: Body }).error)?.message).includes("No such subscription_item: 'si_nope'")
+        || field(idleAfter, 'status') !== 'trialing' || period(idleAfter).id !== period(idle2).id) return false;
+      // a trial made through the API opens its $0 invoice at once, which takes and spends a once coupon, as Checkout's does
+      const withOnce = await h({ m: 'POST', p: '/v1/subscriptions', b: `customer=${id(nobody)}&items[0][price]=${id(price)}&trial_period_days=14&discounts[0][coupon]=${id(once)}` });
+      const trialInvoice = await h({ m: 'GET', p: `/v1/invoices/${String(field(withOnce, 'latest_invoice'))}` });
+      if (field(trialInvoice, 'total') !== 0 || field(trialInvoice, 'status') !== 'paid' || field(trialInvoice, 'billing_reason') !== 'subscription_create'
+        || ((field(trialInvoice, 'discounts') as unknown[] | undefined) ?? []).length !== 1 || !spent(withOnce)) return false;
+      // and the subscription names it from its own create: the customer.subscription.created event carries it
+      const createdEvent = ((((await h({ m: 'GET', p: '/v1/events?type=customer.subscription.created&limit=100' })).body as Body).data as Body[]) ?? [])
+        .find((e) => ((e.data as Body).object as Body).id === id(withOnce));
+      if (((createdEvent?.data as Body | undefined)?.object as Body | undefined)?.latest_invoice !== field(withOnce, 'latest_invoice')) return false;
+      // a card that declines when charged: the change stands, the invoice is open and the subscription past_due
+      const declining = await trialing('declines%40twin.test', 'pm_card_chargeCustomerFail');
+      const invoicesOf = async (s: StripeResponse) => ((((await h({ m: 'GET', p: `/v1/invoices?customer=${String(field(s, 'customer'))}`, day: 5 })).body as Body).data as Body[]) ?? []).length;
+      const before = await invoicesOf(declining);
+      const strict = await h({ m: 'POST', p: `/v1/subscriptions/${id(declining)}`, b: 'trial_end=now&payment_behavior=error_if_incomplete', day: 5 });
+      const still = await h({ m: 'GET', p: `/v1/subscriptions/${id(declining)}`, day: 5 });
+      if (await invoicesOf(declining) !== before) return false;
+      // error_if_incomplete judges the period as the update leaves it: $0 items swapped for a paid price with no payment
+      // method to charge is refused as the create refuses it (semantics/subscriptions.ts firstPaymentRefused)
+      const freeProd = await h({ m: 'POST', p: '/v1/prices', b: `unit_amount=0&currency=usd&recurring[interval]=month&product=${id(prod)}` });
+      const bare = await h({ m: 'POST', p: '/v1/customers', b: 'email=bare%40twin.test' });
+      const free = await h({ m: 'POST', p: '/v1/subscriptions', b: `customer=${id(bare)}&items[0][price]=${id(freeProd)}&trial_period_days=14` });
+      const freeItem = String(period(free).id);
+      const upgrade = await h({ m: 'POST', p: `/v1/subscriptions/${id(free)}`, b: `trial_end=now&payment_behavior=error_if_incomplete&items[0][id]=${freeItem}&items[0][price]=${id(price)}`, day: 5 });
+      const unchanged = await h({ m: 'GET', p: `/v1/subscriptions/${id(free)}`, day: 5 });
+      if (upgrade.status !== 400 || field(unchanged, 'status') !== 'trialing' || (period(unchanged).price as Body | undefined)?.id !== id(freeProd)) return false;
+      // default_incomplete: the period is invoiced and left open, no payment attempted
+      const quiet = await trialing('quiet%40twin.test', 'pm_card_visa');
+      const deferred = await h({ m: 'POST', p: `/v1/subscriptions/${id(quiet)}`, b: 'trial_end=now&payment_behavior=default_incomplete', day: 5 });
+      const unpaid = await h({ m: 'GET', p: `/v1/invoices/${String(field(deferred, 'latest_invoice'))}`, day: 5 });
+      if (field(deferred, 'status') !== 'past_due' || field(unpaid, 'status') !== 'open' || field(unpaid, 'attempted') !== false || field(unpaid, 'amount_paid') !== 0) return false;
+      const lenient = await h({ m: 'POST', p: `/v1/subscriptions/${id(declining)}`, b: 'trial_end=now', day: 5 });
+      const open = await h({ m: 'GET', p: `/v1/invoices/${String(field(lenient, 'latest_invoice'))}`, day: 5 });
+      return strict.status === 402 && field(still, 'status') === 'trialing' && field(still, 'latest_invoice') === field(declining, 'latest_invoice')
+        && field(lenient, 'status') === 'past_due' && field(open, 'status') === 'open' && field(open, 'amount_remaining') === 9000;
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  }),
+  // Automatic reconciliation: a bank transfer arriving in the customer's cash balance pays their open invoice that takes
+  // transfers (docs.stripe.com/payments/customer-balance/reconciliation).
+  done('stripe.customers.cash_balance_reconciliation', 'customers', 'Cash balance funding pays an open bank-transfer invoice (automatic reconciliation)', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const cust = await h({ m: 'POST', p: '/v1/customers', b: 'name=Cowork&email=ap@cowork.test' });
+      const inv = await h({ m: 'POST', p: '/v1/invoices', b: `customer=${id(cust)}&collection_method=send_invoice&days_until_due=30&payment_settings[payment_method_types][0]=customer_balance` });
+      await h({ m: 'POST', p: '/v1/invoiceitems', b: `customer=${id(cust)}&invoice=${id(inv)}&amount=24000&currency=usd` });
+      await h({ m: 'POST', p: `/v1/invoices/${id(inv)}/finalize` });
+      await h({ m: 'POST', p: `/v1/test_helpers/customers/${id(cust)}/fund_cash_balance`, b: 'amount=24000&currency=usd' });
+      const paid = await h({ m: 'GET', p: `/v1/invoices/${id(inv)}` });
+      const bal = await h({ m: 'GET', p: `/v1/customers/${id(cust)}/cash_balance` });
+      return field(paid, 'status') === 'paid' && field(paid, 'amount_paid') === 24000 && ((field(bal, 'available') as Body | null)?.usd ?? 0) === 0;
+    }),
+  ),
+  // A subscription set to cancel at its period's end is canceled when the period ends, with no renewal invoice
+  // (docs.stripe.com/billing/subscriptions/cancel#cancel-at-end-of-cycle).
+  done('stripe.subscriptions.cancel_at_period_end', 'subscriptions', 'cancel_at_period_end cancels the subscription when its period ends', 'api', 'common', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'stp-cape-'));
+    try {
+      const h = (s: Step & { month?: number }) => handleStripeTwinRequest({ method: s.m, path: s.p, body: s.b, root, occurredAt: `2026-${String(s.month ?? 1).padStart(2, '0')}-10T00:00:00Z` });
+      const prod = await h({ m: 'POST', p: '/v1/products', b: 'name=Box' });
+      const price = await h({ m: 'POST', p: '/v1/prices', b: `unit_amount=3500&currency=usd&recurring[interval]=month&product=${id(prod)}` });
+      const cust = await h({ m: 'POST', p: '/v1/customers', b: 'email=leaving@twin.test' });
+      const sub = await h({ m: 'POST', p: '/v1/subscriptions', b: `customer=${id(cust)}&items[0][price]=${id(price)}&default_payment_method=pm_card_visa` });
+      const set = await h({ m: 'POST', p: `/v1/subscriptions/${id(sub)}`, b: 'cancel_at_period_end=true' });
+      const after = await h({ m: 'GET', p: `/v1/subscriptions/${id(sub)}`, month: 3 });
+      const invoices = ((await h({ m: 'GET', p: `/v1/invoices?subscription=${id(sub)}`, month: 3 })).body as Body).data as Body[];
+      return typeof field(set, 'cancel_at') === 'number' && field(after, 'status') === 'canceled' && typeof field(after, 'ended_at') === 'number' && invoices.length === 1;
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  }),
   // Pause/resume: set pause_collection[behavior]=void → the sub records pause_collection (and
   // the customer.subscription.paused event fires); clearing it (pause_collection="") resumes
   // (pause_collection null). cancel_at_period_end toggles a scheduled cancel and reactivation.
@@ -894,12 +1561,12 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
     withRoot(async (h) => {
       const cust = await h({ m: 'POST', p: '/v1/customers', b: 'email=disc@twin.test' });
       const coupon = await h({ m: 'POST', p: '/v1/coupons', b: 'percent_off=25&duration=forever' });
-      const sub = await h({ m: 'POST', p: '/v1/subscriptions', b: `customer=${id(cust)}&coupon=${id(coupon)}` });
+      const sub = await h({ m: 'POST', p: '/v1/subscriptions', b: `customer=${id(cust)}&discounts[0][coupon]=${id(coupon)}` });
       if (!ok(sub)) return false;
       const discs = (field(sub, 'discounts') as Body[]) ?? [];
       if (discs.length !== 1 || discs[0]!.object !== 'discount' || (discs[0]!.coupon as Body)?.id !== id(coupon)) return false;
       // unknown coupon on a fresh sub 400s.
-      const bad = await h({ m: 'POST', p: '/v1/subscriptions', b: `customer=${id(cust)}&coupon=coupon_nope` });
+      const bad = await h({ m: 'POST', p: '/v1/subscriptions', b: `customer=${id(cust)}&discounts[0][coupon]=coupon_nope` });
       if (bad.status !== 400) return false;
       // remove the discount.
       const del = await h({ m: 'DELETE', p: `/v1/subscriptions/${id(sub)}/discount` });
@@ -945,12 +1612,35 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       return ok(payGood) && field(payGood, 'status') === 'paid';
     }),
   ),
-  done('stripe.invoiceitems.crud', 'invoices', 'InvoiceItems: create + list', 'api', 'core', () =>
+  done('stripe.invoiceitems.crud', 'invoices', 'InvoiceItems: create + retrieve + update + list + delete', 'api', 'core', () =>
     withRoot(async (h) => {
       const cust = await h({ m: 'POST', p: '/v1/customers', b: 'email=ii@twin.test' });
       const ii = await h({ m: 'POST', p: '/v1/invoiceitems', b: `customer=${id(cust)}&amount=400&currency=usd` });
       const l = await h({ m: 'GET', p: '/v1/invoiceitems' });
-      return ok(ii) && field(ii, 'object') === 'invoiceitem' && field(l, 'object') === 'list';
+      if (!ok(ii) || field(ii, 'object') !== 'invoiceitem' || field(l, 'object') !== 'list') return false;
+      // an item is reachable by the id its own create handed back
+      const g = await h({ m: 'GET', p: `/v1/invoiceitems/${id(ii)}` });
+      const miss = await h({ m: 'GET', p: '/v1/invoiceitems/ii_nope' });
+      if (!ok(g) || id(g) !== id(ii) || miss.status !== 404) return false;
+      // The earlier pending 400 is swept onto the invoice at creation.
+      // An item on a DRAFT invoice moves the invoice's total when it changes, and again when
+      // it is deleted — an invoice billing for a line that no longer says that is money in
+      // two places at once.
+      const inv = await h({ m: 'POST', p: '/v1/invoices', b: `customer=${id(cust)}` });
+      const on = await h({ m: 'POST', p: '/v1/invoiceitems', b: `customer=${id(cust)}&invoice=${id(inv)}&amount=900&currency=usd` });
+      const u = await h({ m: 'POST', p: `/v1/invoiceitems/${id(on)}`, b: 'amount=1500' });
+      const afterUpdate = await h({ m: 'GET', p: `/v1/invoices/${id(inv)}` });
+      if (!ok(u) || field(afterUpdate, 'amount_due') !== 1900) return false;
+      const del = await h({ m: 'DELETE', p: `/v1/invoiceitems/${id(on)}` });
+      const afterDelete = await h({ m: 'GET', p: `/v1/invoices/${id(inv)}` });
+      const gone = await h({ m: 'GET', p: `/v1/invoiceitems/${id(on)}` });
+      // and once the invoice is finalized its items are no longer deletable, like Stripe
+      const inv2 = await h({ m: 'POST', p: '/v1/invoices', b: `customer=${id(cust)}` });
+      const locked = await h({ m: 'POST', p: '/v1/invoiceitems', b: `customer=${id(cust)}&invoice=${id(inv2)}&amount=700&currency=usd` });
+      await h({ m: 'POST', p: `/v1/invoices/${id(inv2)}/finalize` });
+      const refused = await h({ m: 'DELETE', p: `/v1/invoiceitems/${id(locked)}` });
+      return ok(del) && field(del, 'deleted') === true && field(afterDelete, 'amount_due') === 400
+        && gone.status === 404 && refused.status === 400;
     }),
   ),
   // Invoice send / mark_uncollectible / pay-out-of-band: send auto-finalizes a draft (→ open);
@@ -984,14 +1674,14 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       const prod = await h({ m: 'POST', p: '/v1/products', b: 'name=Plan' });
       const price = await h({ m: 'POST', p: `/v1/prices`, b: `unit_amount=3000&currency=usd&recurring[interval]=month&product=${id(prod)}` });
       const coupon = await h({ m: 'POST', p: '/v1/coupons', b: 'percent_off=10&duration=forever' });
-      const sub = await h({ m: 'POST', p: '/v1/subscriptions', b: `customer=${id(cust)}&items[0][price]=${id(price)}&coupon=${id(coupon)}` });
-      const up = await h({ m: 'GET', p: `/v1/invoices/upcoming?subscription=${id(sub)}` });
+      const sub = await h({ m: 'POST', p: '/v1/subscriptions', b: `customer=${id(cust)}&items[0][price]=${id(price)}&discounts[0][coupon]=${id(coupon)}` });
+      const up = await h({ m: 'POST', p: '/v1/invoices/create_preview', b: `subscription=${id(sub)}` });
       if (!ok(up) || field(up, 'object') !== 'invoice' || field(up, 'id') !== null) return false;
       // subtotal 3000, 10% off → total 2700.
       if (field(up, 'subtotal') !== 3000 || field(up, 'total') !== 2700) return false;
       const lines = (field(up, 'lines') as Body).data as Body[];
       if (lines.length !== 1 || lines[0]!.amount !== 3000) return false;
-      const noCust = await h({ m: 'GET', p: '/v1/invoices/upcoming?customer=cus_nope' });
+      const noCust = await h({ m: 'POST', p: '/v1/invoices/create_preview', b: 'customer=cus_nope' });
       return noCust.status === 404;
     }),
   ),
@@ -1040,6 +1730,20 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       return ok(g) && ok(li) && field(li, 'object') === 'list' && ok(exp);
     }),
   ),
+  // A Checkout line item's description: "An arbitrary string attached to the object. Often useful for displaying to users.
+  // Defaults to product name." (spec/openapi.json.gz, the `item` schema). The session create's line_items take no
+  // description of their own (price, price_data, quantity, adjustable_quantity, metadata, tax_rates), so the name is the
+  // price's product's, or the product_data an inline price names. Dub's Checkout showed its Business plan as "Item".
+  done('stripe.checkout.line_item_description', 'checkout', 'Checkout line items are described by their product\'s name (a price\'s product, or price_data.product_data)', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const prod = await h({ m: 'POST', p: '/v1/products', b: 'name=Business' });
+      const price = await h({ m: 'POST', p: '/v1/prices', b: `unit_amount=9000&currency=usd&product=${id(prod)}` });
+      const cs = await h({ m: 'POST', p: '/v1/checkout/sessions', b: `mode=payment&success_url=https://x.test&line_items[0][price]=${id(price)}&line_items[0][quantity]=2&line_items[1][price_data][currency]=usd&line_items[1][price_data][unit_amount]=100&line_items[1][price_data][product_data][name]=Setup%20fee&line_items[1][quantity]=1` });
+      const items = (((await h({ m: 'GET', p: `/v1/checkout/sessions/${id(cs)}/line_items` })).body as Body).data as Body[]) ?? [];
+      return items.length === 2 && items[0]?.description === 'Business' && items[0]?.amount_total === 18000
+        && items[1]?.description === 'Setup fee' && items[1]?.amount_total === 100;
+    }),
+  ),
   // Completion copies the session's create-only subscription_data onto the created
   // subscription (metadata is how apps bind the checkout attempt → subscription; trial
   // becomes a real trialing window) — and the Session itself never echoes the param.
@@ -1048,7 +1752,8 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       const cust = await h({ m: 'POST', p: '/v1/customers', b: 'email=subdata@twin.test' });
       const cs = await h({ m: 'POST', p: '/v1/checkout/sessions', b: `mode=subscription&success_url=https://x.test&customer=${id(cust)}&line_items[0][price_data][currency]=usd&line_items[0][price_data][unit_amount]=999&line_items[0][quantity]=1&subscription_data[metadata][attemptId]=att_cap_1&subscription_data[trial_period_days]=7` });
       if (!ok(cs) || field(cs, 'subscription_data') !== undefined || field(cs, '_subscription_data') !== undefined) return false;
-      const completed = await h({ m: 'POST', p: `/v1/checkout/sessions/${id(cs)}`, b: 'status=complete' });
+      await h({ m: 'POST', p: `/c/pay/${id(cs)}`, b: 'email=pay%40twin.test&cardNumber=4242424242424242&cardExpiry=12%2F34&cardCvc=123&billingName=Twin&billingCountry=US&billingPostalCode=94105' });
+      const completed = await h({ m: 'GET', p: `/v1/checkout/sessions/${id(cs)}` });
       if (!ok(completed) || !field(completed, 'subscription')) return false;
       const sub = await h({ m: 'GET', p: `/v1/subscriptions/${field(completed, 'subscription')}` });
       const md = field(sub, 'metadata') as Body | undefined;
@@ -1056,13 +1761,219 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
         && typeof field(sub, 'trial_end') === 'number' && field(sub, 'trial_end') === field(sub, 'current_period_end');
     }),
   ),
+  // A subscription session's customer pays its first invoice on the page: the invoice is paid through a succeeded
+  // PaymentIntent and its charge, and the card is the subscription's default payment method
+  // (docs.stripe.com/payments/checkout/how-checkout-works).
+  done('stripe.checkout.subscription_first_invoice', 'checkout', 'Subscription Checkout pays the first invoice with the entered card, the subscription\'s default payment method', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const prod = await h({ m: 'POST', p: '/v1/products', b: 'name=Box' });
+      const price = await h({ m: 'POST', p: '/v1/prices', b: `unit_amount=3500&currency=usd&product=${id(prod)}&recurring[interval]=month` });
+      const cs = await h({ m: 'POST', p: '/v1/checkout/sessions', b: `mode=subscription&success_url=https://x.test&line_items[0][price]=${id(price)}&line_items[0][quantity]=1` });
+      await h({ m: 'POST', p: `/c/pay/${id(cs)}`, b: 'email=pay%40twin.test&cardNumber=4242424242424242&cardExpiry=12%2F34&cardCvc=123&billingName=Twin&billingCountry=US&billingPostalCode=94105' });
+      const done = await h({ m: 'GET', p: `/v1/checkout/sessions/${id(cs)}` });
+      const sub = await h({ m: 'GET', p: `/v1/subscriptions/${String(field(done, 'subscription'))}` });
+      const inv = await h({ m: 'GET', p: `/v1/invoices/${String(field(done, 'invoice'))}` });
+      const pi = await h({ m: 'GET', p: `/v1/payment_intents/${String(field(inv, 'payment_intent'))}` });
+      return field(sub, 'status') === 'active' && typeof field(sub, 'default_payment_method') === 'string'
+        && field(inv, 'status') === 'paid' && field(inv, 'billing_reason') === 'subscription_create' && field(inv, 'amount_paid') === 3500
+        && field(pi, 'status') === 'succeeded' && typeof field(pi, 'latest_charge') === 'string';
+    }),
+  ),
+  // Checkout's expiry field takes the digits typed straight through, as Stripe's formats `1230` into `12 / 30`: the page
+  // marks the field for its formatter, and the posted digits pay and are the card's expiry (screens/checkout.tsx
+  // parseExpiry); two digits are still incomplete.
+  done('stripe.checkout.card_expiry_digits', 'checkout', 'Checkout card expiry accepts digits typed straight through (1230 is 12 / 30), formatted as typed', 'ui', 'common', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'stp-expiry-'));
+    try {
+      const f = createStripeTwinFetch({ root, clock: () => '2026-03-01T00:00:00Z' });
+      const api = async (method: string, path: string, body?: string) => (await f(new Request(`https://api.stripe.com${path}`, { method, headers: { 'content-type': 'application/x-www-form-urlencoded' }, ...(body ? { body } : {}) }))).json() as Promise<Body>;
+      const pay = (cs: Body, expiry: string) => f(new Request(String(cs.url), { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ email: 'pay@twin.test', cardNumber: '4242424242424242', cardExpiry: expiry, cardCvc: '123', billingName: 'Twin', billingCountry: 'US', billingPostalCode: '94105' }).toString() }));
+      const session = () => api('POST', '/v1/checkout/sessions', 'mode=payment&success_url=https://x.test&line_items[0][price_data][currency]=usd&line_items[0][price_data][unit_amount]=2500&line_items[0][price_data][product_data][name]=Pro&line_items[0][quantity]=1');
+      const cs = await session();
+      const html = await (await f(new Request(String(cs.url)))).text();
+      const script = /<script>([\s\S]*?)<\/script>/.exec(html)?.[1] ?? '';
+      const marked = /<input[^>]*id="cardExpiry"[^>]*data-format="card-expiry"/.test(html) && script === FORMAT_SCRIPT;
+      // the page's own script, run over a field as a person types, deletes, pastes or fills it
+      const typed = expiryField(script);
+      const formats = typed.type('1230') === '12 / 30' && expiryField(script).type('5') === '05 / ' && expiryField(script).type('1/3') === '01 / 3'
+        && expiryField(script).fill('12/2030') === '12 / 30' && expiryField(script).fill('122030') === '12 / 30'
+        && (typed.back(), typed.back()) === '12 / ' && typed.back() === '12' && typed.back() === '1';
+      const short = await pay(cs, '12');
+      const shortText = await short.text();
+      const paid = await pay(cs, '1230');
+      const done = await api('GET', `/v1/checkout/sessions/${String(cs.id)}`);
+      const pi = await api('GET', `/v1/payment_intents/${String(done.payment_intent)}`);
+      const card = (await api('GET', `/v1/payment_methods/${String(pi.payment_method)}`)).card as Body | undefined;
+      // a first digit above 1 is the month on its own: 530 is May 2030
+      const other = await session();
+      const may = await pay(other, '530');
+      const pmMay = (await api('GET', `/v1/payment_methods/${String((await api('GET', `/v1/payment_intents/${String((await api('GET', `/v1/checkout/sessions/${String(other.id)}`)).payment_intent)}`)).payment_method)}`)).card as Body | undefined;
+      return marked && formats && short.status === 402 && shortText.includes('expiration date is incomplete')
+        && paid.status === 303 && done.status === 'complete' && card?.exp_month === 12 && card?.exp_year === 2030
+        && may.status === 303 && pmMay?.exp_month === 5 && pmMay?.exp_year === 2030;
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  }),
+  // A subscription session with a trial shows the trial as Checkout does: "14 days free", "Then $90.00 per month", a
+  // "Start trial" button and, under it, when the trial's end charges; one without a trial says Subscribe and its amount
+  // (screens/checkout.tsx trialSummary). The amount and date come from the seeded price and the session's trial.
+  done('stripe.checkout.trial_display', 'checkout', 'Checkout shows a subscription\'s trial: N days free, then the price per interval from the trial\'s end, Start trial', 'ui', 'common', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'stp-trialpage-'));
+    try {
+      const f = createStripeTwinFetch({ root, clock: () => '2026-03-01T00:00:00Z' });
+      const api = async (method: string, path: string, body?: string) => (await f(new Request(`https://api.stripe.com${path}`, { method, headers: { 'content-type': 'application/x-www-form-urlencoded' }, ...(body ? { body } : {}) }))).json() as Promise<Body>;
+      const text = async (cs: Body) => (await (await f(new Request(String(cs.url)))).text()).replace(/<script[\s\S]*?<\/script>/g, '').replace(/<[^>]+>/g, '|');
+      const prod = await api('POST', '/v1/products', 'name=Business');
+      const price = await api('POST', '/v1/prices', `unit_amount=9000&currency=usd&recurring[interval]=month&product=${String(prod.id)}`);
+      const yearly = await api('POST', '/v1/prices', `unit_amount=90000&currency=usd&recurring[interval]=year&product=${String(prod.id)}`);
+      const line = (p: Body) => `mode=subscription&success_url=https://x.test&customer_email=t%40twin.test&line_items[0][price]=${String(p.id)}&line_items[0][quantity]=1`;
+      const trial = await text(await api('POST', '/v1/checkout/sessions', `${line(price)}&subscription_data[trial_period_days]=14`));
+      // a trial set by its end: 2026-03-08 is a week on
+      const byEnd = await text(await api('POST', '/v1/checkout/sessions', `${line(yearly)}&subscription_data[trial_end]=${Date.parse('2026-03-08T00:00:00Z') / 1000}`));
+      const plain = await text(await api('POST', '/v1/checkout/sessions', line(price)));
+      // after the trial a `once` coupon is spent (the trial's $0 invoice took it) and a one-time item is not billed again;
+      // a `forever` coupon still applies
+      const once = await api('POST', '/v1/coupons', 'id=ONCE50&percent_off=50&duration=once');
+      const forever = await api('POST', '/v1/coupons', 'id=EVER10&percent_off=10&duration=forever');
+      const setup = await api('POST', '/v1/prices', `unit_amount=2500&currency=usd&product=${String(prod.id)}`);
+      const spent = await text(await api('POST', '/v1/checkout/sessions', `${line(price)}&subscription_data[trial_period_days]=14&discounts[0][coupon]=${String(once.id)}&line_items[1][price]=${String(setup.id)}&line_items[1][quantity]=1`));
+      const kept = await text(await api('POST', '/v1/checkout/sessions', `${line(price)}&subscription_data[trial_period_days]=14&discounts[0][coupon]=${String(forever.id)}`));
+      // Checkout refuses a trial_end under 48 hours away
+      const soon = await f(new Request('https://api.stripe.com/v1/checkout/sessions', { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: `${line(price)}&subscription_data[trial_end]=${Date.parse('2026-03-02T12:00:00Z') / 1000}` }));
+      if (!spent.includes('|Then $90.00 per month|') || !kept.includes('|Then $81.00 per month|') || soon.status !== 400) return false;
+      // and the twin bills what the page says: the one-time price on the first invoice, then $90.00 a period
+      const paid = await api('POST', '/v1/checkout/sessions', `${line(price)}&subscription_data[trial_period_days]=14&line_items[1][price]=${String(setup.id)}&line_items[1][quantity]=1`);
+      await f(new Request(String(paid.url), { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: 'email=t%40twin.test&cardNumber=4242424242424242&cardExpiry=1230&cardCvc=123&billingName=T&billingCountry=US&billingPostalCode=94105' }));
+      const later = createStripeTwinFetch({ root, clock: () => '2026-03-20T00:00:00Z' });
+      const read = async (path: string) => (await later(new Request(`https://api.stripe.com${path}`))).json() as Promise<Body>;
+      const done = await read(`/v1/checkout/sessions/${String(paid.id)}`);
+      const first = await read(`/v1/invoices/${String(done.invoice)}`);
+      const bills = ((await read(`/v1/invoices?subscription=${String(done.subscription)}`)).data as Body[] | undefined) ?? [];
+      const cycle = bills.find((b) => b.billing_reason === 'subscription_cycle');
+      if (first.total !== 2500 || first.status !== 'paid' || cycle?.total !== 9000) return false;
+      // the same sale in inline price_data: the page and the invoices agree ($25 now, $90 a period)
+      const inlineLines = 'mode=subscription&success_url=https://x.test&customer_email=t%40twin.test&subscription_data[trial_period_days]=14'
+        + `&line_items[0][price_data][currency]=usd&line_items[0][price_data][unit_amount]=9000&line_items[0][price_data][recurring][interval]=month&line_items[0][price_data][product]=${String(prod.id)}&line_items[0][quantity]=1`
+        + '&line_items[1][price_data][currency]=usd&line_items[1][price_data][unit_amount]=2500&line_items[1][price_data][product_data][name]=Setup&line_items[1][quantity]=1';
+      const inlineCs = await api('POST', '/v1/checkout/sessions', inlineLines);
+      const inlinePage = await text(inlineCs);
+      await f(new Request(String(inlineCs.url), { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: 'email=t%40twin.test&cardNumber=4242424242424242&cardExpiry=1230&cardCvc=123&billingName=T&billingCountry=US&billingPostalCode=94105' }));
+      const inlineDone = await read(`/v1/checkout/sessions/${String(inlineCs.id)}`);
+      const inlineFirst = await read(`/v1/invoices/${String(inlineDone.invoice)}`);
+      const inlineBills = ((await read(`/v1/invoices?subscription=${String(inlineDone.subscription)}`)).data as Body[] | undefined) ?? [];
+      if (!inlinePage.includes('|Then $90.00 per month|') || inlineFirst.total !== 2500 || inlineBills.find((b) => b.billing_reason === 'subscription_cycle')?.total !== 9000) return false;
+      return trial.includes('|14 days free|') && trial.includes('|Then $90.00 per month|') && trial.includes('|Start trial|')
+        && trial.includes('After your trial ends, you will be charged $90.00 per month starting March 15, 2026. You can always cancel before then.')
+        && !trial.includes('|Subscribe|')
+        && byEnd.includes('|7 days free|') && byEnd.includes('|Then $900.00 per year|') && byEnd.includes('starting March 8, 2026')
+        && plain.includes('|Subscribe|') && plain.includes('|$90.00|') && !plain.includes('days free') && !plain.includes('Start trial');
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  }),
+  // A session's promotion code discounts it and the subscription it makes; an unknown code and an expired one are
+  // refused at create (docs.stripe.com/api/checkout/sessions/create#create_checkout_session-discounts).
+  done('stripe.checkout.promotion_codes', 'checkout', 'Checkout discounts[].promotion_code: applied, or refused when unknown or expired', 'api', 'common', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'stp-promo-'));
+    try {
+      const h = (s: Step & { day?: number }) => handleStripeTwinRequest({ method: s.m, path: s.p, body: s.b, root, occurredAt: `2026-05-${String(s.day ?? 1).padStart(2, '0')}T12:00:00Z` });
+      const prod = await h({ m: 'POST', p: '/v1/products', b: 'name=Box' });
+      const price = await h({ m: 'POST', p: '/v1/prices', b: `unit_amount=3500&currency=usd&recurring[interval]=month&product=${id(prod)}` });
+      const coupon = await h({ m: 'POST', p: '/v1/coupons', b: 'percent_off=50&duration=once' });
+      const code = await h({ m: 'POST', p: '/v1/promotion_codes', b: `promotion[type]=coupon&promotion[coupon]=${id(coupon)}&code=SPRING&expires_at=1780272000` });
+      const make = (day: number, pc: string) => h({ m: 'POST', p: '/v1/checkout/sessions', b: `mode=subscription&success_url=https://x.test&line_items[0][price]=${id(price)}&line_items[0][quantity]=1&discounts[0][promotion_code]=${pc}`, day });
+      const good = await make(2, id(code));
+      const unknown = await make(2, 'promo_nope');
+      const late = await make(30, id(code));
+      const lateOk = late.status === 200;
+      const june = await handleStripeTwinRequest({ method: 'POST', path: '/v1/checkout/sessions', body: `mode=subscription&success_url=https://x.test&line_items[0][price]=${id(price)}&line_items[0][quantity]=1&discounts[0][promotion_code]=${id(code)}`, root, occurredAt: '2026-06-02T12:00:00Z' });
+      return field(good, 'amount_total') === 1750 && unknown.status === 400 && lateOk && june.status === 400 && ((june.body as Body).error as Body)?.code === 'coupon_expired';
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  }),
+  // A payment session's payment_intent_data makes a destination charge: the payment transfers to the connected account
+  // less the platform's application fee (docs.stripe.com/connect/destination-charges).
+  done('stripe.checkout.destination_charge', 'checkout', 'Checkout payment_intent_data: destination charge with an application fee', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const seller = await onboardedSeller(h);
+      const cs = await h({ m: 'POST', p: '/v1/checkout/sessions', b: `mode=payment&success_url=https://x.test&line_items[0][price_data][currency]=usd&line_items[0][price_data][unit_amount]=5000&line_items[0][quantity]=1&payment_intent_data[application_fee_amount]=750&payment_intent_data[transfer_data][destination]=${seller}` });
+      await h({ m: 'POST', p: `/c/pay/${id(cs)}`, b: 'email=pay%40twin.test&cardNumber=4242424242424242&cardExpiry=12%2F34&cardCvc=123&billingName=Twin&billingCountry=US&billingPostalCode=94105' });
+      const done = await h({ m: 'GET', p: `/v1/checkout/sessions/${id(cs)}?expand[]=payment_intent.latest_charge` });
+      const charge = ((field(done, 'payment_intent') as Body)?.latest_charge ?? {}) as Body;
+      const transfer = await h({ m: 'GET', p: `/v1/transfers/${String(charge.transfer)}` });
+      return field(transfer, 'destination') === seller && field(transfer, 'amount') === 4250 && charge.application_fee_amount === 750;
+    }),
+  ),
+  // Refunding a destination charge with reverse_transfer and refund_application_fee reverses the transfer and refunds the
+  // application fee (docs.stripe.com/connect/destination-charges#issue-refunds).
+  done('stripe.refunds.reverse_transfer', 'payments', 'Refund reverse_transfer + refund_application_fee on a destination charge', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const seller = await onboardedSeller(h);
+      const pi = await h({ m: 'POST', p: '/v1/payment_intents', b: `amount=5000&currency=usd&payment_method=pm_card_visa&confirm=true&application_fee_amount=750&transfer_data[destination]=${seller}` });
+      const refund = await h({ m: 'POST', p: '/v1/refunds', b: `payment_intent=${id(pi)}&reverse_transfer=true&refund_application_fee=true` });
+      const fees = ((await h({ m: 'GET', p: '/v1/application_fees' })).body as Body).data as Body[];
+      const reversal = typeof field(refund, 'transfer_reversal') === 'string';
+      return ok(refund) && reversal && field(refund, 'reverse_transfer') === undefined && fees[0]?.refunded === true && fees[0]?.amount_refunded === 750;
+    }),
+  ),
+  // Hosted Express onboarding: an Account Link is a single-use entry point to the onboarding session
+  // (docs.stripe.com/connect/hosted-onboarding), which collects what a US account owes before card payments
+  // (docs.stripe.com/connect/required-verification-information: eighteen requirements for an individual), the business, its representative and the payout bank account, refuses a
+  // submit that leaves one out, and stores what it was given on the account (docs.stripe.com/connect/express-accounts).
+  done('stripe.connect.hosted_onboarding', 'connect', 'Hosted onboarding collects and stores the business, representative and bank account', 'api', 'common', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'stp-onb-'));
+    try {
+      const h = (s: Step) => handleStripeTwinRequest({ method: s.m, path: s.p, body: s.b, root });
+      const acct = await h({ m: 'POST', p: '/v1/accounts', b: 'type=express&country=US&business_type=individual&email=grower@twin.test' });
+      const owed = (((field(acct, 'requirements') as Body)?.currently_due as string[]) ?? []).length;
+      const link = await h({ m: 'POST', p: '/v1/account_links', b: `account=${id(acct)}&type=account_onboarding&refresh_url=https://x.test/r&return_url=https://x.test/d` });
+      // visiting the link consumes it and opens the onboarding session; a second visit is sent to refresh_url
+      const url = String(field(link, 'url'));
+      const visited = await stripeOnboardingFlow({ root })(new Request(url));
+      const session = visited?.headers.get('location') ?? '';
+      const again = await stripeOnboardingFlow({ root })(new Request(url));
+      // the page offers Stripe's supported industries (a creator or marketer finds Advertising Services) and every state
+      const shown = await (await stripeOnboardingFlow({ root })(new Request(session)))?.text() ?? '';
+      const offers = shown.includes('value="7311"') && shown.includes('Advertising Services') && shown.includes('value="5815"')
+        && shown.includes('value="WY"') && shown.includes('value="DC"') && !shown.includes('value="5967"')
+        && (shown.match(/<option /g) ?? []).length >= 256 + 51;
+      // no industry is chosen for the person, and a padded code is kept as the code
+      const unchosen = shown.includes('<select id="mcc" name="mcc"><option value="" selected="">Select your industry</option>');
+      // an account the platform gave an industry the page offers opens on it; one it does not offer, on no industry
+      const opened = async (mcc: string): Promise<string> => {
+        const a = await h({ m: 'POST', p: '/v1/accounts', b: `type=express&country=US&business_type=individual&business_profile[mcc]=${mcc}` });
+        const l = await h({ m: 'POST', p: '/v1/account_links', b: `account=${id(a)}&type=account_onboarding&refresh_url=https://x.test/r&return_url=https://x.test/d` });
+        const s = (await stripeOnboardingFlow({ root })(new Request(String(field(l, 'url')))))?.headers.get('location') ?? '';
+        return await (await stripeOnboardingFlow({ root })(new Request(s)))?.text() ?? '';
+      };
+      const prefilled = (await opened('7311')).includes('<option value="7311" selected="">') && (await opened('5912')).includes('<option value="" selected="">Select your industry</option>');
+      // an industry the page does not offer (a restricted code) leaves the MCC due
+      const unlisted = currentlyDue('individual', { mcc: '5967' }).includes('business_profile.mcc') && !currentlyDue('individual', { mcc: '7311' }).includes('business_profile.mcc');
+      const partial = await hostedSubmit(root, stripeOnboardingFlow, session, { business_type: 'individual', first_name: 'Ada' });
+      const full = await hostedSubmit(root, stripeOnboardingFlow, session, {
+        mcc: ' 5261 ', url: 'https://grower.test', statement_descriptor: 'GROWER TEST', line1: 'address_full_match', city: 'Portland', state: 'OR', postal_code: '97201',
+        first_name: 'Ada', last_name: 'Grower', email: 'grower@twin.test', phone: '0000000000', dob: '1901-01-01', ssn_last_4: '0000', routing_number: '110000000', account_number: '000123456789', tos: 'accepted',
+      });
+      const after = await h({ m: 'GET', p: `/v1/accounts/${id(acct)}` });
+      const banks = await h({ m: 'GET', p: `/v1/accounts/${id(acct)}/external_accounts` });
+      return owed === 18 && offers && unlisted && unchosen && prefilled && (field(after, 'business_profile') as Body)?.mcc === '5261' && ((field(after, 'requirements') as Body)?.currently_due as string[] | undefined)?.length === 0 && field(after, 'charges_enabled') === true
+        && session.startsWith('https://connect.stripe.com/setup/s/') && again?.headers.get('location') === 'https://x.test/r'
+        && partial?.status === 400 && full?.status === 302 && field(after, 'details_submitted') === true
+        && ((field(after, 'individual') as Body)?.last_name === 'Grower') && ((banks.body as Body).data as Body[])[0]?.last4 === '6789';
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  }),
   // Completing a session fires checkout.session.completed (data.object = the completed
   // Session) and stores it in the Events API — the event most billing flows fulfill from.
   done('stripe.checkout.completed_event', 'checkout', 'Checkout completion emits checkout.session.completed with the session payload', 'api', 'core', () =>
     withRoot(async (h) => {
       const cs = await h({ m: 'POST', p: '/v1/checkout/sessions', b: 'mode=payment&success_url=https://x.test&line_items[0][price_data][currency]=usd&line_items[0][price_data][unit_amount]=2500&line_items[0][quantity]=1' });
       if (!ok(cs)) return false;
-      const completed = await h({ m: 'POST', p: `/v1/checkout/sessions/${id(cs)}`, b: 'status=complete' });
+      await h({ m: 'POST', p: `/c/pay/${id(cs)}`, b: 'email=pay%40twin.test&cardNumber=4242424242424242&cardExpiry=12%2F34&cardCvc=123&billingName=Twin&billingCountry=US&billingPostalCode=94105' });
+      const completed = await h({ m: 'GET', p: `/v1/checkout/sessions/${id(cs)}` });
       if (!ok(completed) || field(completed, 'status') !== 'complete') return false;
       const ev = await h({ m: 'GET', p: '/v1/events?type=checkout.session.completed' });
       const rows = ((ev.body as Body)?.data ?? []) as Body[];
@@ -1071,6 +1982,105 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
         && payload?.id === id(cs) && payload?.status === 'complete' && payload?.payment_status === 'paid';
     }),
   ),
+  // Stripe.js (stripe-js.ts): the @stripe/stripe-js loader injects or accepts a script whose src matches
+  // `/^https:\/\/js\.stripe\.com\/v3\/?(\?.*)?$/` or `/^https:\/\/js\.stripe\.com\/(v3|[a-z]+)\/stripe\.js(\?.*)?$/`
+  // (@stripe/stripe-js 7.x dist/index.mjs) and reads `Stripe.version` (3 for v3, else the train's name). Each such path the
+  // pack's js.stripe.com host claims is served a script defining Stripe with that version, and redirectToCheckout sends
+  // the page to the session's hosted page, checkout.stripe.com/c/pay/{id}.
+  done('stripe.js.loader', 'checkout', 'Stripe.js served at /v3, /v3/, /v3/stripe.js and /<train>/stripe.js; redirectToCheckout opens the hosted Checkout page', 'api', 'common', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'stp-js-'));
+    try {
+      const f = createStripeTwinFetch({ root });
+      const host = pack.hosts?.find((x) => 'host' in x && x.host === 'js.stripe.com');
+      const claims = (p: string) => !!host?.pathPattern && new RegExp(host.pathPattern).test(p);
+      const load = async (p: string): Promise<{ version: unknown; opened: string[] } | undefined> => {
+        const res = await f(new Request(`https://js.stripe.com${p}`));
+        if (res.status !== 200 || !claims(p)) return undefined;
+        const opened: string[] = [];
+        const win: Record<string, unknown> = { location: { assign: (u: string) => opened.push(u) } };
+        new Function('window', await res.text())(win);
+        const Stripe = win.Stripe as ((key: string) => { redirectToCheckout: (o: { sessionId: string }) => unknown }) & { version: unknown };
+        void Stripe('pk_test_twin').redirectToCheckout({ sessionId: 'cs_test_1' });
+        return { version: Stripe.version, opened };
+      };
+      const [v3, v3slash, v3file, basil] = [await load('/v3'), await load('/v3/'), await load('/v3/stripe.js'), await load('/basil/stripe.js')];
+      const other = await f(new Request('https://js.stripe.com/v3/other.js'));
+      return [v3, v3slash, v3file].every((x) => x?.version === 3) && basil?.version === 'basil'
+        && [v3, v3slash, v3file, basil].every((x) => x?.opened.length === 1 && x.opened[0] === 'https://checkout.stripe.com/c/pay/cs_test_1')
+        && other.status === 404;
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  }),
+  // The name customers see: the operator saves the business name on the Dashboard's Public details page
+  // (dashboard.stripe.com/settings/public), which is the platform account's business_profile.name ("The customer-facing
+  // business name", docs.stripe.com/api/accounts/object), and Checkout and the customer portal show it ("You can change a
+  // Checkout page's name by modifying the Business name field", docs.stripe.com/payments/checkout/customization/appearance).
+  done('stripe.dashboard.public_details', 'checkout', 'Dashboard Public details: the business name saved there is the account\'s business_profile.name, shown on Checkout and the customer portal', 'ui', 'common', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'stp-public-'));
+    try {
+      const f = createStripeTwinFetch({ root });
+      const api = async (method: string, path: string, body?: string, account?: string) => (await f(new Request(`https://api.stripe.com${path}`, { method, headers: { 'content-type': 'application/x-www-form-urlencoded', ...(account ? { 'stripe-account': account } : {}) }, ...(body ? { body } : {}) }))).json() as Promise<Body>;
+      const page = async (url: string) => (await f(new Request(url))).text();
+      const save = (name: string) => f(new Request('https://dashboard.stripe.com/settings/public', { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ business_name: name }).toString() }));
+      const cs = await api('POST', '/v1/checkout/sessions', 'mode=payment&success_url=https://x.test&cancel_url=https://x.test/c&line_items[0][price_data][currency]=usd&line_items[0][price_data][unit_amount]=2500&line_items[0][price_data][product_data][name]=Pro&line_items[0][quantity]=1');
+      const before = await page(`https://checkout.stripe.com/c/pay/${String(cs.id)}`);
+      const empty = await save('  ');
+      const saved = await save('Dub');
+      const form = await page('https://dashboard.stripe.com/settings/public');
+      const account = await api('GET', '/v1/account');
+      const checkout = await page(`https://checkout.stripe.com/c/pay/${String(cs.id)}`);
+      const cust = await api('POST', '/v1/customers', 'email=public@twin.test');
+      const bps = await api('POST', '/v1/billing_portal/sessions', `customer=${String(cust.id)}&return_url=https://x.test/account`);
+      const portal = await page(String(bps.url));
+      // a second save changes the name in place and keeps the account's other public details
+      await save('Dub Technologies');
+      const again = await api('GET', '/v1/account');
+      // each save is the account's update, the first included
+      const updated = ((await api('GET', '/v1/events?type=account.updated')).data as Body[] | undefined) ?? [];
+      // a session's own branding_settings.display_name wins; a direct charge's page shows the connected account's name
+      const line = 'mode=payment&success_url=https://x.test&line_items[0][price_data][currency]=usd&line_items[0][price_data][unit_amount]=900&line_items[0][price_data][product_data][name]=Fern&line_items[0][quantity]=1';
+      const branded = await page(String((await api('POST', '/v1/checkout/sessions', `${line}&branding_settings[display_name]=Dub Links`)).url));
+      const grower = await api('POST', '/v1/accounts', 'type=standard&country=US&business_profile[name]=Grower Co');
+      const directSession = await api('POST', '/v1/checkout/sessions', line, String(grower.id));
+      const direct = await page(String(directSession.url));
+      // the name is the page's only use of the account a session was made on: paying it keeps its events where they were
+      // (the twin makes a hosted page's payment on the platform's books), all of them together
+      await f(new Request(String(directSession.url), { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: 'email=fern%40x.test&cardNumber=4242424242424242&cardExpiry=12%2F34&cardCvc=123&billingName=Fern&billingCountry=US&billingPostalCode=94105' }));
+      const completedHere = ((((await api('GET', '/v1/events?type=checkout.session.completed')).data as Body[] | undefined) ?? [])).filter((e) => ((e.data as Body)?.object as Body)?.id === directSession.id);
+      const completedThere = ((await api('GET', '/v1/events?type=checkout.session.completed', undefined, String(grower.id))).data as Body[] | undefined) ?? [];
+      const behalf = await page(String((await api('POST', '/v1/billing_portal/sessions', `customer=${String(cust.id)}&return_url=https://x.test/account&on_behalf_of=${String(grower.id)}`)).url));
+      const subBehalf = await page(String((await api('POST', '/v1/checkout/sessions', `mode=subscription&success_url=https://x.test&line_items[0][price_data][currency]=usd&line_items[0][price_data][unit_amount]=900&line_items[0][price_data][recurring][interval]=month&line_items[0][price_data][product_data][name]=Fern&line_items[0][quantity]=1&subscription_data[on_behalf_of]=${String(grower.id)}`)).url));
+      const onBehalf = await page(String((await api('POST', '/v1/checkout/sessions', `${line}&payment_intent_data[on_behalf_of]=${String(grower.id)}&payment_intent_data[transfer_data][destination]=${String(grower.id)}`)).url));
+      const portalAsGrower = await page(String((await api('POST', '/v1/billing_portal/sessions', `customer=${String(cust.id)}&return_url=https://x.test/account`, String(grower.id))).url));
+      // the page's trailing-slash address posts to itself and comes back to itself
+      const slashed = await page('https://dashboard.stripe.com/settings/public/');
+      const slashSave = await f(new Request('https://dashboard.stripe.com/settings/public/', { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: 'business_name=Dub+Technologies' }));
+      const landed = new URL(slashSave.headers.get('location') ?? '', 'https://dashboard.stripe.com/settings/public/').pathname;
+      // the /_twin/account door, written first, starts the platform's record from the same default and is an update too
+      const door = createStripeTwinFetch({ root: join(root, 'door') });
+      await door(new Request('https://api.stripe.com/_twin/account', { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: 'settings[payouts][schedule][interval]=manual&business_profile[support_email]=help@dub.test' }));
+      // and a save on the page keeps the public details it does not show, as the door keeps the name the page saved
+      await door(new Request('https://dashboard.stripe.com/settings/public', { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: 'business_name=Dub' }));
+      await door(new Request('https://api.stripe.com/_twin/account', { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: 'business_profile[url]=https://dub.test' }));
+      const doorAccount = await (await door(new Request('https://api.stripe.com/v1/account'))).json() as Body;
+      const doorEvents = (((await (await door(new Request('https://api.stripe.com/v1/events?type=account.updated'))).json()) as Body).data as Body[] | undefined) ?? [];
+      const long = await save('x'.repeat(5001));
+      return before.includes('Twin Inc.') && !before.includes('Dub') && empty.status === 400 && saved.status === 303 && long.status === 400
+        && updated.length === 2 && branded.includes('Pay Dub Links') && direct.includes('Pay Grower Co') && completedHere.length === 1 && !completedHere[0]!.account && completedThere.length === 0 && !direct.includes('Dub Technologies') && behalf.includes('Return to Grower Co')
+        && saved.headers.get('location') === '?saved=1' && form.includes('value="Dub"') && !form.includes('action=')
+        && onBehalf.includes('Pay Grower Co') && subBehalf.includes('<div class="pay-merchant">Grower Co</div>') && portalAsGrower.includes('Return to Grower Co')
+        && slashed.includes('name="business_name"') && slashSave.status === 303 && landed === '/settings/public/'
+        && doorAccount.created === 1767225600 && (doorAccount.capabilities as Body)?.card_payments === 'active' && doorEvents.length === 3
+        && (doorAccount.business_profile as Body)?.support_email === 'help@dub.test' && (doorAccount.business_profile as Body)?.name === 'Dub' && (doorAccount.business_profile as Body)?.url === 'https://dub.test'
+        && (((doorAccount.settings as Body)?.payouts as Body)?.schedule as Body)?.interval === 'manual'
+        && (account.business_profile as Body)?.name === 'Dub' && account.id === 'acct_twin_self' && account.charges_enabled === true
+        && checkout.includes('<div class="pay-merchant">Dub</div>') && checkout.includes('Pay Dub') && !checkout.includes('Twin Inc.')
+        && portal.includes('Return to Dub') && portal.includes('<div class="portal-merchant">Dub</div>') && (again.business_profile as Body)?.name === 'Dub Technologies';
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  }),
   done('stripe.billing_portal.session', 'checkout', 'Billing Portal Session create (referential to customer)', 'api', 'common', () =>
     withRoot(async (h) => {
       const cust = await h({ m: 'POST', p: '/v1/customers', b: 'email=portal@twin.test' });
@@ -1078,6 +2088,31 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       return ok(bps) && field(bps, 'object') === 'billing_portal.session' && !!field(bps, 'url');
     }),
   ),
+  // The portal's payment method and invoices: the customer saves a new card (the default their subscription charges)
+  // and pays the open invoice a declined renewal left, which makes the subscription active
+  // (docs.stripe.com/customer-management/configure-portal).
+  done('stripe.billing_portal.payment_method_and_pay', 'checkout', 'Billing Portal: update the payment method and pay an open invoice', 'api', 'common', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'stp-portal-'));
+    try {
+      const h = (s: Step & { month?: number }) => handleStripeTwinRequest({ method: s.m, path: s.p, body: s.b, root, occurredAt: `2026-${String(s.month ?? 1).padStart(2, '0')}-10T00:00:00Z` });
+      const prod = await h({ m: 'POST', p: '/v1/products', b: 'name=Box' });
+      const price = await h({ m: 'POST', p: '/v1/prices', b: `unit_amount=3500&currency=usd&recurring[interval]=month&product=${id(prod)}` });
+      const cust = await h({ m: 'POST', p: '/v1/customers', b: 'email=portal-pay@twin.test' });
+      const sub = await h({ m: 'POST', p: '/v1/subscriptions', b: `customer=${id(cust)}&items[0][price]=${id(price)}&default_payment_method=pm_card_chargeCustomerFail&trial_period_days=7` });
+      const open = (((await h({ m: 'GET', p: `/v1/invoices?subscription=${id(sub)}&status=open`, month: 2 })).body as Body).data as Body[])[0];
+      const bps = await h({ m: 'POST', p: '/v1/billing_portal/sessions', b: `customer=${id(cust)}`, month: 2 });
+      const flow = stripePortalFlow({ root, clock: () => '2026-02-10T00:00:00Z' });
+      const post = (to: string, form: Record<string, string>) => flow(new Request(`https://billing.stripe.com/p/session/${id(bps)}/${to}`, { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams(form).toString() }));
+      const saved = await post('payment_method', { cardNumber: '4242424242424242', cardExpiry: '12/34', cardCvc: '123', billingName: 'Twin', billingCountry: 'US', billingPostalCode: '94105' });
+      const paid = await post('pay', { invoice: String(open?.id) });
+      const after = await h({ m: 'GET', p: `/v1/subscriptions/${id(sub)}`, month: 2 });
+      const inv = await h({ m: 'GET', p: `/v1/invoices/${String(open?.id)}`, month: 2 });
+      return saved?.status === 303 && paid?.status === 303 && field(inv, 'status') === 'paid'
+        && field(after, 'status') === 'active' && field(after, 'default_payment_method') !== 'pm_card_chargeCustomerFail';
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  }),
   done('stripe.billing_portal.configuration', 'checkout', 'Billing Portal Configurations: create + retrieve + update + list', 'api', 'common', () =>
     withRoot(async (h) => {
       const c = await h({ m: 'POST', p: '/v1/billing_portal/configurations', b: 'business_profile[headline]=Hi&features[customer_update][enabled]=true' });
@@ -1087,8 +2122,6 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       return ok(g) && id(g) === id(c) && field(l, 'object') === 'list';
     }),
   ),
-  outOfScope('stripe.checkout.hosted_page', 'checkout', 'Hosted Checkout PAGE pixel rendering', 'ui', 'niche', 'Out of scope: the Session/API is modeled; the hosted PAGE pixels are out of scope.'),
-  outOfScope('stripe.billing_portal.hosted_page', 'checkout', 'Hosted Customer Portal PAGE pixel rendering', 'ui', 'niche', 'Out of scope: the Session/API is modeled; the hosted PAGE pixels are out of scope.'),
 
   // ── Payment Links / Quotes ────────────────────────────────────────────────────────
   // Payment Links: create (referential to a Price) → active link with a share url + line_items
@@ -1150,10 +2183,13 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       return ok(g) && ok(u) && ok(ll) && field(ll, 'object') === 'login_link' && ok(del) && field(del, 'deleted') === true;
     }),
   ),
-  done('stripe.connect.transfers', 'connect', 'Connect Transfers: create (referential to dest account) + retrieve + list', 'api', 'niche', () =>
+  done('stripe.connect.transfers', 'connect', 'Connect Transfers: to an account whose transfers capability is active, from the platform\'s balance + retrieve + list', 'api', 'niche', () =>
     withRoot(async (h) => {
-      const a = await h({ m: 'POST', p: '/v1/accounts', b: 'type=express' });
-      const t = await h({ m: 'POST', p: '/v1/transfers', b: `amount=500&currency=usd&destination=${id(a)}` });
+      const seller = await onboardedSeller(h);
+      // an account still onboarding cannot receive transfers
+      const fresh = await h({ m: 'POST', p: '/v1/accounts', b: 'type=express&capabilities[transfers][requested]=true' });
+      if ((await h({ m: 'POST', p: '/v1/transfers', b: `amount=500&currency=usd&destination=${id(fresh)}` })).status !== 400) return false;
+      const t = await h({ m: 'POST', p: '/v1/transfers', b: `amount=500&currency=usd&destination=${seller}` });
       if (!ok(t) || field(t, 'object') !== 'transfer') return false;
       const g = await h({ m: 'GET', p: `/v1/transfers/${id(t)}` });
       const l = await h({ m: 'GET', p: '/v1/transfers' });
@@ -1162,6 +2198,48 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       return ok(g) && field(l, 'object') === 'list' && bad.status >= 400;
     }),
   ),
+  // docs.stripe.com/connect/separate-charges-and-transfers, "Transfer availability": a transfer tied to a charge succeeds
+  // while the charge's funds are pending ("if the related charge hasn't settled yet"; once they have, it is held to the
+  // available balance), never takes more than the charge (less what was reversed of it), takes the charge's
+  // transfer_group over one the request names or, the charge having none, `group_` plus its PaymentIntent id, which the
+  // charge takes too, and pays the destination when the charge's funds become available. (Dub pays its partners this
+  // way: a card charge, then source_transaction.)
+  done('stripe.connect.transfer_source_transaction', 'connect', 'Connect Transfers from a charge\'s pending funds (source_transaction)', 'api', 'common', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'stp-src-'));
+    try {
+      const h = (s: Step & { acct?: string; day?: number }) => handleStripeTwinRequest({ method: s.m, path: s.p, body: s.b, root, occurredAt: `2026-06-${String(s.day ?? 1).padStart(2, '0')}T12:00:00Z`, ...(s.acct ? { stripeAccount: s.acct } : {}) });
+      const a = await h({ m: 'POST', p: '/v1/accounts', b: 'type=custom&country=US&capabilities[transfers][requested]=true&business_profile[mcc]=5462&business_profile[url]=https://seller.test&tos_acceptance[date]=1767225600&tos_acceptance[ip]=203.0.113.9&settings[payouts][schedule][interval]=manual' });
+      const seller = id(a);
+      await h({ m: 'POST', p: `/v1/accounts/${seller}/external_accounts`, b: 'external_account[object]=bank_account&external_account[country]=US&external_account[currency]=usd&external_account[routing_number]=110000000&external_account[account_number]=000123456789' });
+      await h({ m: 'POST', p: '/_twin/account', b: 'settings[payouts][schedule][interval]=manual' });
+      const pi = await h({ m: 'POST', p: '/v1/payment_intents', b: 'amount=2592&currency=usd&payment_method=pm_card_visa&confirm=true&transfer_group=inv_7' });
+      const charge = field(pi, 'latest_charge') as string;
+      const t = await h({ m: 'POST', p: '/v1/transfers', b: `amount=2400&currency=usd&destination=${seller}&source_transaction=${charge}&transfer_group=mine` });
+      const over = await h({ m: 'POST', p: '/v1/transfers', b: `amount=500&currency=usd&destination=${seller}&source_transaction=${charge}` });
+      const sellerBalance = await h({ m: 'GET', p: '/v1/balance', acct: seller });
+      const pending = ((sellerBalance.body as Body).pending as Array<{ amount: number }> | undefined)?.[0]?.amount;
+      if (!ok(pi) || !ok(t) || field(t, 'source_transaction') !== charge || field(t, 'transfer_group') !== 'inv_7' || over.status !== 400 || pending !== 2400) return false;
+      // what was reversed of a transfer is room again
+      await h({ m: 'POST', p: `/v1/transfers/${id(t)}/reversals`, b: 'amount=400' });
+      const again = await h({ m: 'POST', p: '/v1/transfers', b: `amount=500&currency=usd&destination=${seller}&source_transaction=${charge}` });
+      // no transfer_group on the charge: group_ plus its PaymentIntent id, on the transfer and on the charge
+      const plain = await h({ m: 'POST', p: '/v1/payment_intents', b: 'amount=2000&currency=usd&payment_method=pm_card_visa&confirm=true' });
+      const plainCharge = field(plain, 'latest_charge') as string;
+      const grouped = await h({ m: 'POST', p: '/v1/transfers', b: `amount=500&currency=usd&destination=${seller}&source_transaction=${plainCharge}` });
+      const chargeAfter = await h({ m: 'GET', p: `/v1/charges/${plainCharge}` });
+      if (!ok(again) || field(grouped, 'transfer_group') !== `group_${id(plain)}` || field(chargeAfter, 'transfer_group') !== `group_${id(plain)}`) return false;
+      // day 5: both charges have settled, so a transfer from one is held to the platform's available balance
+      // (2487 + 1912 − 2400 + 400 − 500 − 500 = 1399)
+      const tooMuch = await h({ m: 'POST', p: '/v1/transfers', b: `amount=1500&currency=usd&destination=${seller}&source_transaction=${plainCharge}`, day: 5 });
+      const fits = await h({ m: 'POST', p: '/v1/transfers', b: `amount=1000&currency=usd&destination=${seller}&source_transaction=${plainCharge}`, day: 5 });
+      // an authorization is no source of funds until it is captured (the twin's rule: the docs are silent)
+      const held = await h({ m: 'POST', p: '/v1/payment_intents', b: 'amount=900&currency=usd&capture_method=manual&payment_method=pm_card_visa&confirm=true', day: 5 });
+      const fromHold = await h({ m: 'POST', p: '/v1/transfers', b: `amount=100&currency=usd&destination=${seller}&source_transaction=${String(field(held, 'latest_charge'))}`, day: 5 });
+      const sellerAfter = (((await h({ m: 'GET', p: '/v1/transfers', day: 5 })).body as Body).data as Body[]) ?? [];
+      return tooMuch.status === 400 && ((tooMuch.body as Body).error as Body)?.code === 'balance_insufficient' && ok(fits)
+        && fromHold.status === 400 && !sellerAfter.some((x) => x.source_transaction === field(held, 'latest_charge'));
+    } finally { rmSync(root, { recursive: true, force: true }); }
+  }),
   // (account_links, persons, external_accounts, transfer_reversals, application_fees,
   // capabilities upgraded to done() in the AUDIT GROWTH block below.)
   // Connect payouts (Stripe-Account): a payout created WITH a Stripe-Account header is attributed
@@ -1171,8 +2249,10 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
     const root = mkdtempSync(join(tmpdir(), 'stp-cpo-'));
     try {
       const h = (s: Step & { acct?: string }) => handleStripeTwinRequest({ method: s.m, path: s.p, body: s.b, root, ...(s.acct ? { stripeAccount: s.acct } : {}) });
-      const acct = await h({ m: 'POST', p: '/v1/accounts', b: 'type=express&country=US' });
-      // a platform payout (no header) and a connected-account payout (with header).
+      const seller = await onboardedSeller(h);
+      const acct = { status: 200, body: { id: seller } } as StripeResponse;
+      await h({ m: 'POST', p: '/v1/transfers', b: `amount=3000&currency=usd&destination=${seller}` });
+      // a platform payout (no header) and a connected-account payout (with header), each from its own balance.
       const plat = await h({ m: 'POST', p: '/v1/payouts', b: 'amount=1000&currency=usd' });
       const conn = await h({ m: 'POST', p: '/v1/payouts', b: 'amount=2000&currency=usd', acct: id(acct) });
       if (!ok(plat) || !ok(conn)) return false;
@@ -1196,6 +2276,65 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
   // Top-ups: POST /v1/topups funds the platform balance (amount + currency required); the twin
   // succeeds a test top-up immediately. retrieve/list/update round-trip; a succeeded top-up
   // cannot be canceled (400); missing money 400; unknown id 404.
+  // Connect webhooks (docs.stripe.com/connect/webhooks): an endpoint created with `connect` true receives the Connected
+  // accounts scope, one without it Your account; "Each event for a connected account contains a top-level `account`
+  // property that identifies the connected account". A write made as the account (the Stripe-Account header) and the
+  // account's own account.updated are its events; the platform's own writes are the platform's.
+  done('stripe.connect.webhook_scope', 'connect', 'Connect webhooks: a connected account\'s events reach only connect endpoints, with top-level account; the platform\'s only the others', 'api', 'common', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'stp-scope-'));
+    const rx = await webhookReceiver();
+    try {
+      const h = fetcher(createStripeTwinFetch({ root }));
+      await h('POST', '/v1/webhook_endpoints', `url=${rx.url('/platform')}&enabled_events[]=*`);
+      await h('POST', '/v1/webhook_endpoints', `url=${rx.url('/connect')}&enabled_events[]=*&connect=true`);
+      const seller = String((await h('POST', '/v1/accounts', 'type=express&country=US')).id);
+      const theirs = String((await h('POST', '/v1/customers', 'email=buyer@seller.test', seller)).id);
+      const ours = String((await h('POST', '/v1/customers', 'email=buyer@platform.test')).id);
+      const at = (path: string, type: string, object: string) => rx.got(path).filter((e) => e.type === type && (e.data.object as Body).id === object);
+      const theirsC = at('/connect', 'customer.created', theirs);
+      const oursP = at('/platform', 'customer.created', ours);
+      return theirsC.length === 1 && theirsC[0]!.account === seller && at('/platform', 'customer.created', theirs).length === 0
+        && oursP.length === 1 && !('account' in oursP[0]!) && at('/connect', 'customer.created', ours).length === 0
+        && rx.got('/connect').some((e) => e.type === 'account.updated' && e.account === seller)
+        && !rx.got('/platform').some((e) => e.type === 'account.updated');
+    } finally {
+      rx.close();
+      rmSync(root, { recursive: true, force: true });
+    }
+  }),
+  // A connected account's event is its own even when no request acted as it: the automatic payout World time makes for
+  // it (semantics/balance.ts) goes to connect endpoints with `account`. The Events API answers each account its own
+  // events: with the Stripe-Account header that account's, without it the platform's (semantics/webhook-endpoints.ts).
+  done('stripe.connect.event_scope', 'connect', 'A connected account\'s automatic payout event is scoped to it; the Events API lists and retrieves per account', 'api', 'common', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'stp-evscope-'));
+    const rx = await webhookReceiver();
+    try {
+      let now = '2026-06-01T12:00:00.000Z';
+      const h = fetcher(createStripeTwinFetch({ root, clock: () => now }));
+      await h('POST', '/v1/webhook_endpoints', `url=${rx.url('/platform')}&enabled_events[]=*`);
+      await h('POST', '/v1/webhook_endpoints', `url=${rx.url('/connect')}&enabled_events[]=*&connect=true`);
+      const seller = String((await h('POST', '/v1/accounts', 'type=custom&country=US&capabilities[transfers][requested]=true&business_profile[mcc]=5462&business_profile[url]=https://seller.test&tos_acceptance[date]=1767225600&tos_acceptance[ip]=203.0.113.9')).id);
+      await h('POST', `/v1/accounts/${seller}/external_accounts`, 'external_account[object]=bank_account&external_account[country]=US&external_account[currency]=usd&external_account[routing_number]=110000000&external_account[account_number]=000123456789');
+      await h('POST', '/v1/charges', 'amount=100000&currency=usd&source=tok_bypassPending');
+      await h('POST', '/v1/transfers', `amount=5000&currency=usd&destination=${seller}`);
+      now = '2026-06-03T12:00:00.000Z';
+      await h('GET', '/v1/balance');
+      const theirPayout = rx.got('/connect').find((e) => e.type === 'payout.created');
+      if (theirPayout?.account !== seller || (theirPayout.data.object as Body).amount !== 5000) return false;
+      if (rx.got('/platform').some((e) => e.type === 'payout.created' && (e.data.object as Body).id === (theirPayout.data.object as Body).id)) return false;
+      const theirs = ((await h('GET', '/v1/events?limit=100', undefined, seller)).data as Body[]) ?? [];
+      const ours = ((await h('GET', '/v1/events?limit=100')).data as Body[]) ?? [];
+      const listed = theirs.find((e) => e.type === 'payout.created');
+      const hidden = await h('GET', `/v1/events/${String(listed?.id)}`);
+      const shown = await h('GET', `/v1/events/${String(listed?.id)}`, undefined, seller);
+      return theirs.length > 0 && theirs.every((e) => e.account === seller) && listed !== undefined
+        && ours.length > 0 && ours.every((e) => !('account' in e)) && ours.some((e) => e.type === 'transfer.created')
+        && (hidden.error as Body | undefined)?.code === 'resource_missing' && shown.id === listed.id && shown.account === seller;
+    } finally {
+      rx.close();
+      rmSync(root, { recursive: true, force: true });
+    }
+  }),
   done('stripe.connect.top_ups', 'connect', 'Top-ups (fund platform balance)', 'api', 'niche', () =>
     withRoot(async (h) => {
       const tu = await h({ m: 'POST', p: '/v1/topups', b: 'amount=50000&currency=usd&statement_descriptor=Top up' });
@@ -1226,19 +2365,24 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
   // the old fabricating path returned 200 for a missing file and would fail this assertion.
   done('stripe.file_links.create', 'files', 'FileLinks: create (requires file)', 'api', 'niche', () =>
     withRoot(async (h) => {
-      const f = await h({ m: 'POST', p: '/v1/file_links', b: 'file=file_twin' });
-      if (!ok(f) || field(f, 'object') !== 'file_link' || field(f, 'file') !== 'file_twin') return false;
+      const up = await h({ m: 'POST', p: '/v1/files', b: 'purpose=dispute_evidence&file=evidence.png' });
+      const f = await h({ m: 'POST', p: '/v1/file_links', b: `file=${id(up)}` });
+      if (!ok(f) || field(f, 'object') !== 'file_link' || field(f, 'file') !== id(up)) return false;
+      // a file of a purpose the link's file parameter does not list is refused
+      const logo = await h({ m: 'POST', p: '/v1/files', b: 'purpose=issuing_logo&file=logo.png' });
+      if ((await h({ m: 'POST', p: '/v1/file_links', b: `file=${id(logo)}` })).status !== 400) return false;
       const missing = await h({ m: 'POST', p: '/v1/file_links', b: 'expires_at=0' });
       return missing.status === 400 && ((missing.body as Body).error as Body)?.code === 'parameter_missing';
     }),
   ),
   // (files.upload upgraded to done() in the AUDIT GROWTH block below.)
-  // Identity VerificationReports: materialize from a verified session (test helper
-  // POST .../verify), then list (filterable by verification_session) + retrieve. Unknown id 404.
+  // Identity VerificationReports: the person verifies on verify.stripe.com, which makes the report; then list
+  // (filterable by verification_session) + retrieve. Unknown id 404.
   done('stripe.identity.verification_reports', 'identity', 'Identity VerificationReports', 'api', 'niche', () =>
-    withRoot(async (h) => {
+    withRoot(async (h, root) => {
       const vs = await h({ m: 'POST', p: '/v1/identity/verification_sessions', b: 'type=document' });
-      const ver = await h({ m: 'POST', p: `/v1/identity/verification_sessions/${id(vs)}/verify` });
+      await hostedSubmit(root, stripeIdentityFlow, `https://verify.stripe.com/start/${id(vs)}`, { outcome: 'verified' });
+      const ver = await h({ m: 'GET', p: `/v1/identity/verification_sessions/${id(vs)}` });
       if (!ok(ver) || field(ver, 'status') !== 'verified') return false;
       const reportId = field(ver, 'last_verification_report') as string;
       if (!reportId?.startsWith('vr_')) return false;
@@ -1253,10 +2397,12 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
   ),
 
   // ── Events / Webhooks / Idempotency ───────────────────────────────────────────────
-  done('stripe.events.list', 'events', 'Events: create + retrieve + list', 'api', 'core', () =>
+  done('stripe.events.list', 'events', 'Events: a write records its event; retrieve + list', 'api', 'core', () =>
     withRoot(async (h) => {
-      const e = await h({ m: 'POST', p: '/v1/events', b: 'type=twin.synthetic' });
-      if (!ok(e) || field(e, 'object') !== 'event') return false;
+      await h({ m: 'POST', p: '/v1/customers', b: 'email=events@twin.test' });
+      const first = (((await h({ m: 'GET', p: '/v1/events' })).body as Body).data as Body[])[0]!;
+      const e = { status: 200, body: first } as StripeResponse;
+      if (field(e, 'object') !== 'event' || field(e, 'type') !== 'customer.created') return false;
       const g = await h({ m: 'GET', p: `/v1/events/${id(e)}` });
       const l = await h({ m: 'GET', p: '/v1/events' });
       return ok(g) && id(g) === id(e) && field(l, 'object') === 'list';
@@ -1284,7 +2430,17 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
         if (!report.ok || posts.length !== 1) return false;
         // verified with the same scheme stripe.webhooks.constructEvent implements
         const evt = constructEvent(posts[0]!.body, posts[0]!.headers['stripe-signature']!, secret);
-        if (evt.type !== 'invoice.paid' || (evt.data.object as Body).id !== id(inv)) return false;
+        if (evt.type !== 'invoice.paid' || (evt.data.object as Body).id !== id(inv) || 'account' in evt) return false;
+        // a connected account's object re-fires as its event: a payout kept on its books carries the account
+        // (at noon: an automatic payout, made at midnight, would take the funds first)
+        const noon = (m: string, p: string, b?: string, acct?: string) => handleStripeTwinRequest({ method: m, path: p, body: b, root, occurredAt: '2026-08-01T12:00:00Z', ...(acct ? { stripeAccount: acct } : {}) });
+        const seller = await onboardedSeller((s) => noon(s.m, s.p, s.b));
+        await noon('POST', '/v1/transfers', `amount=5000&currency=usd&destination=${seller}`);
+        const po = await noon('POST', '/v1/payouts', 'amount=4000&currency=usd', seller);
+        await H('POST', '/v1/webhook_endpoints', `url=${encodeURIComponent('http://127.0.0.1:1/connect')}&enabled_events[0]=payout.*&connect=true`);
+        const scoped: string[] = [];
+        await emitTwinEvent(stripeEmitter, { type: 'payout.created', subjectId: id(po), root, fetchFn: async (_url, init) => { scoped.push(init.body); return { status: 200 }; } });
+        if (scoped.length === 0 || !scoped.every((b) => (JSON.parse(b) as Body).account === seller)) return false;
         // unknown subject → LOUD, listing what exists
         return await emitTwinEvent(stripeEmitter, { type: 'invoice.paid', subjectId: 'in_twin_999', root }).then(() => false, (e: unknown) => /no invoice "in_twin_999"/.test(String(e)));
       });
@@ -1412,7 +2568,7 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
     withRoot(async (h) => {
       const cus = await h({ m: 'POST', p: '/v1/customers', b: 'email=ev@example.com' });
       if (!ok(cus)) return false;
-      const pi = await h({ m: 'POST', p: '/v1/payment_intents', b: 'amount=2000&currency=usd' });
+      const pi = await h({ m: 'POST', p: '/v1/payment_intents', b: 'amount=2000&currency=usd&transfer_group=inv_42' });
       const conf = await h({ m: 'POST', p: `/v1/payment_intents/${id(pi)}/confirm`, b: 'payment_method=pm_card_visa' });
       const pm = await h({ m: 'POST', p: '/v1/payment_methods', b: 'type=card&card[number]=4242424242424242&card[exp_month]=4&card[exp_year]=2030' });
       const att = await h({ m: 'POST', p: `/v1/payment_methods/${id(pm)}/attach`, b: `customer=${id(cus)}` });
@@ -1421,8 +2577,11 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       if (!ok(list) || (list.body as Body).object !== 'list') return false;
       const events = (list.body as Body).data as Array<Record<string, unknown>>;
       const types = new Set(events.map((e) => e.type as string));
-      const wanted = ['customer.created', 'payment_intent.created', 'payment_intent.succeeded', 'payment_method.attached'];
-      if (!wanted.every((t) => types.has(t))) return false;
+      const wanted = ['customer.created', 'payment_intent.created', 'payment_intent.succeeded', 'charge.succeeded', 'payment_method.attached'];
+      if (!wanted.every((t) => types.has(t)) || types.has('charge.created')) return false;
+      // the payment's charge is the event's object and carries the intent's transfer_group (Dub reads its payout invoice from it)
+      const charged = (events.find((e) => e.type === 'charge.succeeded')?.data as Body)?.object as Body | undefined;
+      if (charged?.object !== 'charge' || charged.payment_intent !== id(pi) || charged.transfer_group !== 'inv_42') return false;
       // envelope shape: object 'event', carries the resource snapshot under data.object
       const succeeded = events.find((e) => e.type === 'payment_intent.succeeded');
       if (!succeeded || succeeded.object !== 'event' || ((succeeded.data as Body)?.object as Body)?.status !== 'succeeded') return false;
@@ -1447,8 +2606,8 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       const e1 = await h({ m: 'GET', p: `/v1/payment_intents/${id(pi)}?expand[]=customer` });
       if (!ok(e1) || ((field(e1, 'customer') as Body)?.object) !== 'customer' || (field(e1, 'customer') as Body)?.id !== id(cust)) return false;
       // a charge whose customer + payment_intent chain expands deeply (charge.payment_intent.customer).
-      const ch = await h({ m: 'POST', p: `/v1/charges`, b: `amount=1000&currency=usd&customer=${id(cust)}&payment_intent=${id(pi)}` });
-      const e2 = await h({ m: 'GET', p: `/v1/charges/${id(ch)}?expand[]=payment_intent.customer` });
+      const ch = await h({ m: 'POST', p: '/v1/payment_intents', b: `amount=1000&currency=usd&customer=${id(cust)}&payment_method=pm_card_visa&confirm=true` });
+      const e2 = await h({ m: 'GET', p: `/v1/charges/${String(field(ch, 'latest_charge'))}?expand[]=payment_intent.customer` });
       const expandedPi = field(e2, 'payment_intent') as Body;
       if (!expandedPi || expandedPi.object !== 'payment_intent' || (expandedPi.customer as Body)?.id !== id(cust)) return false;
       // list-level expand (expand[]=data.customer) expands the field on every row.
@@ -1522,43 +2681,48 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
   // ── Test helpers ──────────────────────────────────────────────────────────────────
   // Test clocks: create a clock at a frozen_time, then advance it; advancing past a trialing
   // subscription's trial_end transitions that sub trialing→active (the real clock-tick effect).
-  // Advancing backwards 400s; missing frozen_time 400s; delete removes it. (the clock object +
-  // the trial→active transition on advance are produced ONLY by this feature.)
+  // Advancing backwards 400s; advancing while advancing 400s test_clock_not_ready; missing frozen_time 400s; delete
+  // removes it.
   done('stripe.test_clocks', 'test-helpers', 'Test clocks (advance time for subscription/invoice)', 'api', 'common', () =>
-    withRoot(async (h) => {
+    withRoot(async (h, root) => {
       const clock = await h({ m: 'POST', p: '/v1/test_helpers/test_clocks', b: 'frozen_time=1000&name=T' });
       if (!ok(clock) || field(clock, 'object') !== 'test_helpers.test_clock' || field(clock, 'frozen_time') !== 1000) return false;
       // a trialing subscription whose trial_end is 5000.
       const cust = await h({ m: 'POST', p: '/v1/customers', b: 'email=clock@twin.test' });
       const sub = await h({ m: 'POST', p: '/v1/subscriptions', b: `customer=${id(cust)}&trial_end=5000` });
       if (field(sub, 'status') !== 'trialing') return false;
-      // advancing PAST trial_end transitions the sub to active.
+      // advancing PAST trial_end: the clock advances for a few seconds (a second advance meanwhile is refused), then the
+      // trial has ended and the sub is active
       const adv = await h({ m: 'POST', p: `/v1/test_helpers/test_clocks/${id(clock)}/advance`, b: 'frozen_time=6000' });
-      if (!ok(adv) || field(adv, 'frozen_time') !== 6000) return false;
-      const subAfter = await h({ m: 'GET', p: `/v1/subscriptions/${id(sub)}` });
+      if (!ok(adv) || field(adv, 'status') !== 'advancing') return false;
+      const busy = await h({ m: 'POST', p: `/v1/test_helpers/test_clocks/${id(clock)}/advance`, b: 'frozen_time=7000' });
+      if (busy.status !== 400 || ((busy.body as Body).error as Body)?.code !== 'test_clock_not_ready') return false;
+      const later = new Date(Date.now() + 10_000).toISOString();
+      const subAfter = await handleStripeTwinRequest({ method: 'GET', path: `/v1/subscriptions/${id(sub)}`, root, occurredAt: later });
       if (field(subAfter, 'status') !== 'active') return false;
-      const back = await h({ m: 'POST', p: `/v1/test_helpers/test_clocks/${id(clock)}/advance`, b: 'frozen_time=1' });
+      const back = await handleStripeTwinRequest({ method: 'POST', path: `/v1/test_helpers/test_clocks/${id(clock)}/advance`, body: 'frozen_time=1', root, occurredAt: later });
       const noTime = await h({ m: 'POST', p: '/v1/test_helpers/test_clocks' });
       const del = await h({ m: 'DELETE', p: `/v1/test_helpers/test_clocks/${id(clock)}` });
       const gone = await h({ m: 'GET', p: `/v1/test_helpers/test_clocks/${id(clock)}` });
       return back.status === 400 && noTime.status === 400 && ok(del) && field(del, 'deleted') === true && gone.status === 404;
     }),
   ),
-  // Test-helper Issuing endpoints: fund_balance accrues the issuing balance; present an
+  // Issuing: a top-up to the Issuing balance funds it; the test-helper endpoints present an
   // authorization (the test-mode way to simulate card usage) → a 'pending' authorization
   // awaiting approve/decline; create_force_capture lands a settled transaction directly.
   // Missing required params 400; unknown card 400. (Exercised together with the issuing family.)
-  done('stripe.test_helpers.issuing', 'test-helpers', 'Test-helper endpoints (fund balance, present authorization)', 'api', 'niche', () =>
-    withRoot(async (h) => {
-      const fund = await h({ m: 'POST', p: '/v1/test_helpers/issuing/fund_balance', b: 'amount=100000&currency=usd' });
-      if (!ok(fund) || ((field(fund, 'issuing') as Body)?.available as Body[])[0]?.amount !== 100000) return false;
+  done('stripe.test_helpers.issuing', 'test-helpers', 'Test-helper endpoints (present authorization, force capture), on an Issuing balance a top-up funded', 'api', 'niche', () =>
+    withRoot(async (h, root) => {
+      const fund = await fundIssuing(root, 100000);
+      const bal = await h({ m: 'GET', p: '/v1/balance' });
+      if (!ok(fund) || ((field(bal, 'issuing') as Body)?.available as Body[])[0]?.amount !== 100000) return false;
       const ch = await h({ m: 'POST', p: '/v1/issuing/cardholders', b: 'name=Jane&type=individual&billing[address][line1]=1 Main&billing[address][city]=SF&billing[address][country]=US&billing[address][postal_code]=94105&billing[address][state]=CA' });
       const card = await h({ m: 'POST', p: `/v1/issuing/cards`, b: `cardholder=${id(ch)}&currency=usd&type=virtual` });
       const auth = await h({ m: 'POST', p: '/v1/test_helpers/issuing/authorizations', b: `card=${id(card)}&amount=2500` });
       if (!ok(auth) || field(auth, 'status') !== 'pending' || (field(auth, 'card') as Body)?.id !== id(card) || field(auth, 'cardholder') !== id(ch)) return false;
       const forced = await h({ m: 'POST', p: '/v1/test_helpers/issuing/transactions/create_force_capture', b: `card=${id(card)}&amount=1000` });
       if (!ok(forced) || field(forced, 'type') !== 'capture' || field(forced, 'amount') !== -1000) return false;
-      const noAmt = await h({ m: 'POST', p: '/v1/test_helpers/issuing/fund_balance', b: 'currency=usd' });
+      const noAmt = await h({ m: 'POST', p: '/v1/topups', b: 'currency=usd&destination_balance=issuing' });
       const badCard = await h({ m: 'POST', p: '/v1/test_helpers/issuing/authorizations', b: 'card=ic_nope&amount=100' });
       return noAmt.status === 400 && badCard.status === 400;
     }),
@@ -1665,18 +2829,27 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
         ((l.body as Body).data as Body[]).length === 2 && badCh.status === 400 && badStatus.status === 400;
     }),
   ),
-  // Authorizations (+approve/decline): an authorization is PRESENTED via the test helper (pending),
-  // then /approve closes it (approved:true) AND materializes a captured transaction, or /decline
-  // closes it (approved:false). Acting on a finalized authorization 400s; unknown id 404.
+  // Authorizations (+approve/decline): an authorization is PRESENTED via the test helper (pending);
+  // /approve keeps it pending (approved:true, funds held) until the merchant's capture closes it and
+  // makes the transaction; /decline closes it (approved:false). Deciding twice 400s; unknown id 404.
   done('stripe.issuing.authorizations', 'issuing', 'Issuing Authorizations (+approve/decline)', 'api', 'niche', () =>
-    withRoot(async (h) => {
+    withRoot(async (h, root) => {
+      await fundIssuing(root, 10000000); // the Issuing balance authorizations are paid from
       const ch = await h({ m: 'POST', p: '/v1/issuing/cardholders', b: 'name=Jane&type=individual&billing[address][country]=US' });
       const card = await h({ m: 'POST', p: `/v1/issuing/cards`, b: `cardholder=${id(ch)}&currency=usd&type=virtual` });
+      // with no real-time endpoint an authorization is approved at once (card_active)
+      const plain = await h({ m: 'POST', p: '/v1/test_helpers/issuing/authorizations', b: `card=${id(card)}&amount=1000` });
+      if (field(plain, 'approved') !== true || ((field(plain, 'request_history') as Body[])?.[0] as Body | undefined)?.reason !== 'card_active') return false;
+      // an endpoint that does not answer leaves it pending for the deprecated approve and decline
+      await h({ m: 'POST', p: '/v1/webhook_endpoints', b: `url=${encodeURIComponent('https://rt.twin.test/auth')}&enabled_events[]=issuing_authorization.request` });
       const auth = await h({ m: 'POST', p: '/v1/test_helpers/issuing/authorizations', b: `card=${id(card)}&amount=3000` });
       if (field(auth, 'status') !== 'pending') return false;
       const appr = await h({ m: 'POST', p: `/v1/issuing/authorizations/${id(auth)}/approve` });
-      if (!ok(appr) || field(appr, 'status') !== 'closed' || field(appr, 'approved') !== true) return false;
-      // approve materialized a captured transaction.
+      if (!ok(appr) || field(appr, 'status') !== 'pending' || field(appr, 'approved') !== true) return false;
+      // nothing is transacted until the merchant captures
+      if ((((await h({ m: 'GET', p: '/v1/issuing/transactions' })).body as Body).data as Body[]).length !== 0) return false;
+      const cap = await h({ m: 'POST', p: `/v1/test_helpers/issuing/authorizations/${id(auth)}/capture` });
+      if (!ok(cap) || field(cap, 'status') !== 'closed') return false;
       const txns = await h({ m: 'GET', p: '/v1/issuing/transactions' });
       const txnData = (txns.body as Body).data as Body[];
       if (txnData.length !== 1 || txnData[0]!.authorization !== id(auth) || txnData[0]!.amount !== -3000) return false;
@@ -1696,7 +2869,8 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
   // retrieved/updated and disputed. A dispute requires transaction + evidence[reason]; /submit
   // transitions unsubmitted→submitted; submitting twice 400s; unknown transaction 400.
   done('stripe.issuing.transactions', 'issuing', 'Issuing Transactions + disputes', 'api', 'niche', () =>
-    withRoot(async (h) => {
+    withRoot(async (h, root) => {
+      await fundIssuing(root, 10000000); // the Issuing balance authorizations are paid from
       const ch = await h({ m: 'POST', p: '/v1/issuing/cardholders', b: 'name=Jane&type=individual&billing[address][country]=US' });
       const card = await h({ m: 'POST', p: `/v1/issuing/cards`, b: `cardholder=${id(ch)}&currency=usd&type=virtual` });
       const auth = await h({ m: 'POST', p: '/v1/test_helpers/issuing/authorizations', b: `card=${id(card)}&amount=4200` });
@@ -1729,6 +2903,7 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
     const root = mkdtempSync(join(tmpdir(), 'stp-cap-'));
     try {
       const h = (s: Step) => handleStripeTwinRequest({ method: s.m, path: s.p, body: s.b, root, occurredAt: '2026-06-14T00:00:00Z' });
+      await fundIssuing(root, 10000000, '2026-06-14T00:00:00Z'); // the Issuing balance authorizations are paid from
       const delivered: StripeEvent[] = [];
       setStripeEventDelivery((_url, event) => {
         delivered.push(event);
@@ -1781,15 +2956,16 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       rmSync(root, { recursive: true, force: true });
     }
   }),
-  // Real-time authorization fallbacks (the 2s-window posture, fail-closed): a webhook
-  // decline closes the authorization (reason webhook_declined); a TIMEOUT declines with
-  // reason webhook_timeout; an invalid response (non-2xx, non-JSON, missing `approved`)
+  // Real-time authorization fallbacks (the 2s window): a webhook decline closes the
+  // authorization (reason webhook_declined); a TIMEOUT leaves it pending for the deprecated
+  // approve/decline until the window ends, then declines it with reason webhook_timeout; an invalid response (non-2xx, non-JSON, missing `approved`)
   // declines with reason webhook_error + a reason_message; a partial `amount` in the
   // response is held ONLY when the presentment was is_amount_controllable.
-  done('stripe.issuing.realtime_auth_fallbacks', 'issuing', 'Real-time authorization: decline honored; timeout → webhook_timeout; invalid response → webhook_error; partial amount only when controllable', 'api', 'niche', async () => {
+  done('stripe.issuing.realtime_auth_fallbacks', 'issuing', 'Real-time authorization: decline honored; unanswered → pending, approve in the window, webhook_timeout after it; invalid response → webhook_error; partial amount only when controllable', 'api', 'niche', async () => {
     const root = mkdtempSync(join(tmpdir(), 'stp-cap-'));
     try {
       const h = (s: Step) => handleStripeTwinRequest({ method: s.m, path: s.p, body: s.b, root, occurredAt: '2026-06-14T00:00:00Z' });
+      await fundIssuing(root, 10000000, '2026-06-14T00:00:00Z'); // the Issuing balance authorizations are paid from
       const ch = await h({ m: 'POST', p: '/v1/issuing/cardholders', b: 'name=FB&type=individual&billing[address][country]=US' });
       const card = await h({ m: 'POST', p: '/v1/issuing/cards', b: `cardholder=${id(ch)}&currency=usd&type=virtual` });
       await h({ m: 'POST', p: '/v1/webhook_endpoints', b: `url=${encodeURIComponent('https://rt.twin.test/auth')}&enabled_events[]=issuing_authorization.request` });
@@ -1805,10 +2981,17 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       respond({ status: 200, body: '{"approved":false}' });
       const dec = await present(`card=${id(card)}&amount=900`);
       if (field(dec, 'approved') !== false || field(dec, 'status') !== 'closed' || reasonOf(dec).reason !== 'webhook_declined') return false;
-      // timeout → webhook_timeout (the exact TimeoutError AbortSignal.timeout raises)
+      // an unanswered request (the exact TimeoutError AbortSignal.timeout raises) is no decision: pending with its request
       respond(() => { const e = new Error('timed out'); e.name = 'TimeoutError'; throw e; });
       const to = await present(`card=${id(card)}&amount=900`);
-      if (field(to, 'approved') !== false || reasonOf(to).reason !== 'webhook_timeout') return false;
+      if (field(to, 'status') !== 'pending' || field(to, 'approved') !== false || !field(to, 'pending_request')) return false;
+      // the deprecated approve inside the window decides it
+      const held = await present(`card=${id(card)}&amount=800`);
+      const approved = await h({ m: 'POST', p: `/v1/issuing/authorizations/${id(held)}/approve` });
+      if (field(approved, 'approved') !== true || reasonOf(approved).reason !== 'webhook_approved') return false;
+      // once the 2-second window has passed, the one left unanswered is declined with reason webhook_timeout
+      const later = await handleStripeTwinRequest({ method: 'GET', path: `/v1/issuing/authorizations/${id(to)}`, root, occurredAt: '2026-06-14T00:00:03Z' });
+      if (field(later, 'status') !== 'closed' || field(later, 'approved') !== false || reasonOf(later).reason !== 'webhook_timeout') return false;
       // invalid responses → webhook_error with a reason_message
       for (const bad of [{ status: 500, body: 'oops' }, { status: 200, body: 'not-json' }, { status: 200, body: '{"ok":true}' }]) {
         respond(bad);
@@ -1838,6 +3021,7 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
     const root = mkdtempSync(join(tmpdir(), 'stp-cap-'));
     try {
       const h = (s: Step) => handleStripeTwinRequest({ method: s.m, path: s.p, body: s.b, root, occurredAt: '2026-06-14T00:00:00Z' });
+      await fundIssuing(root, 10000000, '2026-06-14T00:00:00Z'); // the Issuing balance authorizations are paid from
       setStripeEventDelivery((_url, event) => {
         if (event.type === 'issuing_authorization.request') return { status: 200, body: '{"approved":true}' };
       });
@@ -1876,7 +3060,7 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       rmSync(root, { recursive: true, force: true });
     }
   }),
-  // Capture debits the issuing balance: fund_balance accrues the float, a webhook-approved
+  // Capture debits the issuing balance: a top-up to Issuing funds the float, a webhook-approved
   // authorization is captured via POST /v1/test_helpers/issuing/authorizations/:id/capture
   // (partial capture_amount honored, refused above the held amount / on a non-approved or
   // closed authorization), the materialized transaction is type 'capture' with a NEGATIVE
@@ -1897,8 +3081,7 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       const ch = await h({ m: 'POST', p: '/v1/issuing/cardholders', b: 'name=Cap&type=individual&billing[address][country]=US' });
       const card = await h({ m: 'POST', p: '/v1/issuing/cards', b: `cardholder=${id(ch)}&currency=usd&type=virtual` });
       await h({ m: 'POST', p: '/v1/webhook_endpoints', b: `url=${encodeURIComponent('https://rt.twin.test/auth')}&enabled_events[]=issuing_authorization.request` });
-      const fund = await h({ m: 'POST', p: '/v1/test_helpers/issuing/fund_balance', b: 'amount=100000&currency=usd' });
-      if (((field(fund, 'issuing') as Body).available as Body[])[0]!.amount !== 100000) return false;
+      await fundIssuing(root, 100000, '2026-06-14T00:00:00Z');
       if (await issuingAvailable() !== 100000) return false;
       const auth = await h({ m: 'POST', p: '/v1/test_helpers/issuing/authorizations', b: `card=${id(card)}&amount=30000` });
       if (field(auth, 'approved') !== true) return false;
@@ -1941,6 +3124,29 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
   // Readers (+process_payment_intent): a reader registers with a registration_code (status
   // 'online'); handing it a PaymentIntent sets reader.action to process_payment_intent
   // in_progress; cancel_action clears it. Connection tokens mint a secret. Missing code 400.
+  // A simulated reader processing a PaymentIntent is presented a card by the test helper: the intent is paid and the
+  // reader's action succeeds (docs.stripe.com/api/terminal/readers/present_payment_method).
+  done('stripe.terminal.present_payment_method', 'terminal', 'Terminal test helper: present a card to a reader processing a PaymentIntent', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const loc = await h({ m: 'POST', p: '/v1/terminal/locations', b: 'display_name=Market&address[line1]=1 Main&address[city]=Portland&address[state]=OR&address[postal_code]=97201&address[country]=US' });
+      const rdr = await h({ m: 'POST', p: '/v1/terminal/readers', b: `registration_code=simulated-wpe&location=${id(loc)}` });
+      const pi = await h({ m: 'POST', p: '/v1/payment_intents', b: 'amount=2400&currency=usd&allowed_payment_method_types[0]=card_present' });
+      await h({ m: 'POST', p: `/v1/terminal/readers/${id(rdr)}/process_payment_intent`, b: `payment_intent=${id(pi)}` });
+      const done = await h({ m: 'POST', p: `/v1/test_helpers/terminal/readers/${id(rdr)}/present_payment_method` });
+      const paid = await h({ m: 'GET', p: `/v1/payment_intents/${id(pi)}` });
+      // under manual capture the card holds the amount as an uncaptured charge, which the intent's capture takes
+      const held = await h({ m: 'POST', p: '/v1/payment_intents', b: 'amount=1800&currency=usd&capture_method=manual&allowed_payment_method_types[0]=card_present' });
+      await h({ m: 'POST', p: `/v1/terminal/readers/${id(rdr)}/process_payment_intent`, b: `payment_intent=${id(held)}` });
+      await h({ m: 'POST', p: `/v1/test_helpers/terminal/readers/${id(rdr)}/present_payment_method` });
+      const hold = await h({ m: 'GET', p: `/v1/payment_intents/${id(held)}` });
+      const auth = await h({ m: 'GET', p: `/v1/charges/${String(field(hold, 'latest_charge'))}` });
+      const cap = await h({ m: 'POST', p: `/v1/payment_intents/${id(held)}/capture` });
+      const taken = await h({ m: 'GET', p: `/v1/charges/${String(field(hold, 'latest_charge'))}` });
+      return ((field(done, 'action') as Body)?.status === 'succeeded') && field(paid, 'status') === 'succeeded' && typeof field(paid, 'latest_charge') === 'string'
+        && field(hold, 'status') === 'requires_capture' && field(auth, 'captured') === false && field(auth, 'amount') === 1800
+        && field(cap, 'latest_charge') === id(auth) && field(taken, 'captured') === true && field(taken, 'amount_captured') === 1800;
+    }),
+  ),
   done('stripe.terminal.readers', 'terminal', 'Terminal Readers (+process_payment_intent)', 'api', 'niche', () =>
     withRoot(async (h) => {
       const loc = await h({ m: 'POST', p: '/v1/terminal/locations', b: 'display_name=HQ&address[country]=US&address[line1]=1 Main&address[city]=SF&address[postal_code]=94105&address[state]=CA' });
@@ -2090,22 +3296,23 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
 
   // ── Reporting ────────────────────────────────────────────────────────────────────
   // Reporting report_runs + report_types: POST /v1/reporting/report_runs requires
-  // parameters[report_type] (a valid type from the catalog); the twin completes the run
-  // synchronously (status 'succeeded') with a result File ref. Unknown/missing report_type 400.
+  // report_type (a valid type from the catalog); a run starts pending and completes a
+  // minute later (status 'succeeded') with a result File ref. Unknown/missing report_type 400.
   // The report-type catalog is listable/retrievable.
   done('stripe.reporting.report_runs', 'reporting', 'Reporting (report_runs + report_types)', 'api', 'niche', () =>
-    withRoot(async (h) => {
+    withRoot(async (h, root) => {
       const types = await h({ m: 'GET', p: '/v1/reporting/report_types' });
       if (!ok(types) || ((types.body as Body).data as Body[]).length === 0) return false;
       const one = await h({ m: 'GET', p: '/v1/reporting/report_types/balance.summary.1' });
       if (!ok(one) || field(one, 'object') !== 'reporting.report_type') return false;
-      const run = await h({ m: 'POST', p: '/v1/reporting/report_runs', b: 'parameters[report_type]=balance.summary.1&parameters[interval_start]=0&parameters[interval_end]=100' });
-      if (!ok(run) || field(run, 'object') !== 'reporting.report_run' || field(run, 'status') !== 'succeeded' || field(run, 'report_type') !== 'balance.summary.1') return false;
-      if ((field(run, 'result') as Body)?.object !== 'file') return false;
-      const g = await h({ m: 'GET', p: `/v1/reporting/report_runs/${id(run)}` });
+      const run = await h({ m: 'POST', p: '/v1/reporting/report_runs', b: 'report_type=balance.summary.1&parameters[interval_start]=0&parameters[interval_end]=100' });
+      if (!ok(run) || field(run, 'object') !== 'reporting.report_run' || field(run, 'status') !== 'pending' || field(run, 'report_type') !== 'balance.summary.1') return false;
+      // "Most runs complete within a few minutes" (docs.stripe.com/reports/api): read two minutes on, it has succeeded
+      const g = await handleStripeTwinRequest({ method: 'GET', path: `/v1/reporting/report_runs/${id(run)}`, root, occurredAt: new Date(Date.now() + 120_000).toISOString() });
+      if (field(g, 'status') !== 'succeeded' || (field(g, 'result') as Body)?.object !== 'file') return false;
       const l = await h({ m: 'GET', p: '/v1/reporting/report_runs' });
       const noType = await h({ m: 'POST', p: '/v1/reporting/report_runs', b: 'parameters[interval_start]=0' });
-      const badType = await h({ m: 'POST', p: '/v1/reporting/report_runs', b: 'parameters[report_type]=bogus.report' });
+      const badType = await h({ m: 'POST', p: '/v1/reporting/report_runs', b: 'report_type=bogus.report' });
       const nope = await h({ m: 'GET', p: '/v1/reporting/report_runs/frr_nope' });
       const badTypeRetrieve = await h({ m: 'GET', p: '/v1/reporting/report_types/bogus.report' });
       return ok(g) && id(g) === id(run) && ((l.body as Body).data as Body[]).length === 1 &&
@@ -2113,25 +3320,24 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
     }),
   ),
   // Reporting API (the modellable part of Sigma/Financial reports): report_types catalog +
-  // report_runs create→result. A run requires a valid parameters[report_type] (else 400),
-  // starts and completes to 'succeeded' with a result File ref. The Sigma SQL warehouse
-  // itself is out-of-scope (see the out-of-scope entry below). Unknown type 400.
+  // report_runs create→result. A run requires a valid report_type (else 400),
+  // starts pending and completes to 'succeeded' with a result File ref a minute later. The Sigma scheduled-query
+  // surface is filed separately as a todo. Unknown type 400.
   done('stripe.sigma_financial', 'reporting', 'Financial reports / Sigma (Reporting API)', 'api', 'niche', () =>
-    withRoot(async (h) => {
+    withRoot(async (h, root) => {
       const types = await h({ m: 'GET', p: '/v1/reporting/report_types' });
       if (!ok(types) || field(types, 'object') !== 'list' || ((types.body as Body).data as Body[]).length === 0) return false;
-      const run = await h({ m: 'POST', p: '/v1/reporting/report_runs', b: 'parameters[report_type]=balance.summary.1' });
-      if (!ok(run) || field(run, 'object') !== 'reporting.report_run' || field(run, 'status') !== 'succeeded') return false;
-      if ((field(run, 'result') as Body)?.object !== 'file') return false;
-      const get = await h({ m: 'GET', p: `/v1/reporting/report_runs/${id(run)}` });
+      const run = await h({ m: 'POST', p: '/v1/reporting/report_runs', b: 'report_type=balance.summary.1' });
+      if (!ok(run) || field(run, 'object') !== 'reporting.report_run' || field(run, 'status') !== 'pending') return false;
+      const get = await handleStripeTwinRequest({ method: 'GET', path: `/v1/reporting/report_runs/${id(run)}`, root, occurredAt: new Date(Date.now() + 120_000).toISOString() });
+      if (field(get, 'status') !== 'succeeded' || (field(get, 'result') as Body)?.object !== 'file') return false;
       const list = await h({ m: 'GET', p: '/v1/reporting/report_runs' });
-      const badType = await h({ m: 'POST', p: '/v1/reporting/report_runs', b: 'parameters[report_type]=not.a.type' });
-      const missing = await h({ m: 'POST', p: '/v1/reporting/report_runs', b: 'metadata[x]=1' });
+      const badType = await h({ m: 'POST', p: '/v1/reporting/report_runs', b: 'report_type=not.a.type' });
+      const missing = await h({ m: 'POST', p: '/v1/reporting/report_runs', b: 'parameters[interval_start]=0' });
       return ok(get) && field(list, 'object') === 'list' && badType.status === 400 && missing.status === 400;
     }),
   ),
-  outOfScope('stripe.sigma_financial.warehouse', 'reporting', 'Sigma SQL query warehouse (scheduled SQL queries)', 'api', 'niche',
-    'Out of scope: Sigma is a hosted SQL analytics warehouse over your account data — running arbitrary SQL against a managed data lake is not locally reproducible. The Reporting API (report_types + report_runs) IS modeled (stripe.sigma_financial).'),
+  todo('stripe.sigma.scheduled_query_runs', 'reporting', 'Sigma scheduled query runs: GET /v1/sigma/scheduled_query_runs list + retrieve, with the run object\'s status/result-file lifecycle (the Reporting API half is already modeled by stripe.sigma_financial)', 'api', 'niche'),
 
   // ── Connector (full pull/push) ────────────────────────────────────────────────────
   done('stripe.connector.read_surface', 'connector', 'Connector read surface (list core collections in one pass)', 'connector', 'core', () =>
@@ -2165,8 +3371,11 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
         pushed.push(`${method} ${path}`);
         return { id: 'ext_pushed', object: 'customer' };
       }) as unknown as Parameters<typeof fullSyncStripe>[0];
+      const { performPending } = await import('./stripe-perform-harness.ts');
+      // protocol 2: the head performs the pending write, the refresh folds the account — two halves, not one
+      const sent = await performPending(execute as never, { root, occurredAt: '2024-01-01T00:00:00.000Z' });
       const res = await fullSyncStripe(execute, { root, occurredAt: '2024-01-01T00:00:00.000Z' });
-      if (res.pushed < 1 || pushed.length < 1) return false; // the pending create was pushed
+      if (sent.pushed < 1 || pushed.length < 1) return false; // the pending create was performed
       if (res.observed < 1 || res.collections < 11) return false; // all collections + webhooks pulled
       // the pulled real customer is now in the twin's projection.
       const list = await handleStripeTwinRequest({ method: 'GET', path: '/v1/customers', root });
@@ -2225,12 +3434,15 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
   // screen reads → render the mirror's OWN ListPane → assert the seeded charge id survives.
   done('stripe.ui.refunds', 'ui-dashboard', 'Dashboard: Refunds screen (data-coupled)', 'ui', 'core', uiDataCoupled({
     markers: ['Refunds', 'list-row'],
-    seed: async (h) => { await h({ m: 'POST', p: '/v1/refunds', b: 'charge=ch_ui_check_refund&amount=555' }); },
+    seed: async (h) => {
+      const charge = await h({ m: 'POST', p: '/v1/charges', b: 'amount=1000&currency=usd&description=ui_check_refund' });
+      await h({ m: 'POST', p: '/v1/refunds', b: `charge=${id(charge)}&amount=555` });
+    },
     check: async ({ get }) => {
       const rows = ((await get('/v1/refunds')).data as Body[]) as unknown as StripeRow[];
       if (!rows.length) return false;
       const markup = renderSectionList('refunds', rows);
-      return listRows(markup) === rows.length && rows.some((r) => r.charge === 'ch_ui_check_refund' && r.amount === 555);
+      return listRows(markup) === rows.length && rows.some((r) => typeof r.charge === 'string' && r.amount === 555);
     },
   })),
   // TWIN-14 (B4) migration — was a marker-grep over the literal 'Subscriptions'; now
@@ -2308,12 +3520,12 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
   // screen reads → render the mirror's OWN ListPane → assert the seeded charge id survives.
   done('stripe.ui.disputes', 'ui-dashboard', 'Dashboard: Disputes screen (data-coupled)', 'ui', 'common', uiDataCoupled({
     markers: ['Disputes', 'list-row'],
-    seed: async (h) => { await h({ m: 'POST', p: '/v1/disputes', b: 'charge=ch_ui_check_dispute&amount=1000&currency=usd' }); },
+    seed: async (h) => { await disputed(h, 1234); },
     check: async ({ get }) => {
       const rows = ((await get('/v1/disputes')).data as Body[]) as unknown as StripeRow[];
       if (!rows.length) return false;
       const markup = renderSectionList('disputes', rows);
-      return listRows(markup) === rows.length && rows.some((d) => d.charge === 'ch_ui_check_dispute' && d.amount === 1000);
+      return listRows(markup) === rows.length && rows.some((d) => d.amount === 1234);
     },
   })),
   // TWIN-14 (B4) migration — was a marker-grep over the literal 'Payouts'; now data-coupled:
@@ -2321,7 +3533,10 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
   // reads → render the mirror's OWN ListPane → assert the seeded amount survives.
   done('stripe.ui.payouts', 'ui-dashboard', 'Dashboard: Payouts screen (data-coupled)', 'ui', 'core', uiDataCoupled({
     markers: ['Payouts', 'list-row'],
-    seed: async (h) => { await h({ m: 'POST', p: '/v1/payouts', b: 'amount=7777&currency=usd' }); },
+    seed: async (h) => {
+      await h({ m: 'POST', p: '/v1/charges', b: 'amount=10000&currency=usd&source=tok_bypassPending' });
+      await h({ m: 'POST', p: '/v1/payouts', b: 'amount=7777&currency=usd' });
+    },
     check: async ({ get }) => {
       const rows = ((await get('/v1/payouts')).data as Body[]) as unknown as StripeRow[];
       if (!rows.length) return false;
@@ -2338,7 +3553,7 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
   // empty workspace's balance has no buckets → `BalanceSummary` renders nothing.
   done('stripe.ui.balance', 'ui-dashboard', 'Dashboard: Balance + Balance Transactions screens (data-coupled)', 'ui', 'core', uiDataCoupled({
     markers: ['Balance', 'Balance Transactions', 'balance-summary'],
-    seed: async (h) => { await h({ m: 'POST', p: '/v1/balance_transactions', b: 'amount=424200&currency=usd' }); },
+    seed: async (h) => { await h({ m: 'POST', p: '/v1/charges', b: 'amount=424200&currency=usd&source=tok_bypassPending' }); },
     check: async ({ get }) => {
       const balance = await get('/v1/balance');
       const txns = ((await get('/v1/balance_transactions')).data as Body[]) as unknown as StripeRow[];
@@ -2358,8 +3573,8 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
   done('stripe.ui.connect', 'ui-dashboard', 'Dashboard: Connect (Connected Accounts + Transfers) screens (data-coupled)', 'ui', 'niche', uiDataCoupled({
     markers: ['Connected Accounts', 'Transfers', 'connect-flag'],
     seed: async (h) => {
-      const acct = await h({ m: 'POST', p: '/v1/accounts', b: 'type=express&country=US' });
-      await h({ m: 'POST', p: '/v1/transfers', b: `amount=999&currency=usd&destination=${(acct.body as Body).id}` });
+      const seller = await onboardedSeller(h);
+      await h({ m: 'POST', p: '/v1/transfers', b: `amount=999&currency=usd&destination=${seller}` });
     },
     check: async ({ get }) => {
       const accounts = ((await get('/v1/accounts')).data as Body[]) as unknown as StripeRow[];
@@ -2377,40 +3592,34 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
   // screen reads → render the mirror's OWN ListPane → assert the seeded type survives.
   done('stripe.ui.events', 'ui-dashboard', 'Dashboard: Events log screen (data-coupled)', 'ui', 'core', uiDataCoupled({
     markers: ['Events', 'list-row'],
-    seed: async (h) => { await h({ m: 'POST', p: '/v1/events', b: 'type=ui.check.event' }); },
+    seed: async (h) => { await h({ m: 'POST', p: '/v1/coupons', b: 'percent_off=10&duration=once' }); },
     check: async ({ get }) => {
       const rows = ((await get('/v1/events')).data as Body[]) as unknown as StripeRow[];
       if (!rows.length) return false;
       const markup = renderSectionList('events', rows);
-      return listRows(markup) === rows.length && rows.some((e) => e.type === 'ui.check.event') && markup.includes('ui.check.event');
+      return listRows(markup) === rows.length && rows.some((e) => e.type === 'coupon.created') && markup.includes('coupon.created');
     },
   })),
-  // TWIN-14 (B4) migration — was a marker-grep over the literals 'Credit Notes', 'Customer Tax
-  // IDs', 'Customer Balance'; now data-coupled: seed a credit note, a customer tax id, and a
-  // customer balance transaction, each with a distinct value → fetch the SAME `/v1/credit_notes`
-  // + `/v1/tax_ids` + `/v1/customer_balance_transactions` projections those screens read →
-  // render the mirror's OWN ListPane over each → assert every seeded value survives.
-  done('stripe.ui.billing_credit', 'ui-dashboard', 'Dashboard: Credit Notes + Customer Tax IDs + Customer Balance screens (data-coupled)', 'ui', 'common', uiDataCoupled({
-    markers: ['Credit Notes', 'Customer Tax IDs', 'Customer Balance', 'list-row'],
+  // Dashboard: credit notes and the account's tax IDs, data-coupled: seed a credit note and the account's own VAT
+  // number, fetch the same `/v1/credit_notes` and `/v1/tax_ids` lists those screens read, render the mirror's own
+  // ListPane over each and assert the seeded rows survive.
+  done('stripe.ui.billing_credit', 'ui-dashboard', 'Dashboard: Credit Notes + Tax IDs screens (data-coupled)', 'ui', 'common', uiDataCoupled({
+    markers: ['Credit Notes', 'Tax IDs', 'list-row'],
     seed: async (h) => {
       const cust = await h({ m: 'POST', p: '/v1/customers', b: 'email=billing-credit-check@twin.test' });
       const custId = (cust.body as Body).id;
       const inv = await h({ m: 'POST', p: '/v1/invoices', b: `customer=${custId}` });
       await h({ m: 'POST', p: '/v1/credit_notes', b: `invoice=${(inv.body as Body).id}&amount=2500&reason=order_change` });
-      await h({ m: 'POST', p: `/v1/customers/${custId}/tax_ids`, b: 'type=eu_vat&value=DE999999999' });
-      await h({ m: 'POST', p: `/v1/customers/${custId}/balance_transactions`, b: 'amount=-750&currency=usd' });
+      await h({ m: 'POST', p: '/v1/tax_ids', b: 'type=eu_vat&value=DE999999999' });
     },
     check: async ({ get }) => {
       const notes = ((await get('/v1/credit_notes')).data as Body[]) as unknown as StripeRow[];
       const taxIds = ((await get('/v1/tax_ids')).data as Body[]) as unknown as StripeRow[];
-      const custBal = ((await get('/v1/customer_balance_transactions')).data as Body[]) as unknown as StripeRow[];
-      if (!notes.length || !taxIds.length || !custBal.length) return false;
+      if (!notes.length || !taxIds.length) return false;
       const notesMarkup = renderSectionList('credit_notes', notes);
       const taxMarkup = renderSectionList('tax_ids', taxIds);
-      const balMarkup = renderSectionList('customer_balance_transactions', custBal);
       return listRows(notesMarkup) === notes.length && notes.some((n) => n.amount === 2500) &&
-        listRows(taxMarkup) === taxIds.length && taxIds.some((t) => t.value === 'DE999999999') &&
-        listRows(balMarkup) === custBal.length && custBal.some((b) => b.amount === -750);
+        listRows(taxMarkup) === taxIds.length && taxIds.some((t) => t.value === 'DE999999999');
     },
   })),
   // TWIN-14 (B4) migration — was a marker-grep over the literal 'Payment error'; now
@@ -2468,7 +3677,7 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
   // per seeded run carrying its report_type (fails on an empty workspace).
   done('stripe.ui.reports', 'ui-dashboard', 'Dashboard: Reports / analytics screen', 'ui', 'niche', uiDataCoupled({
     markers: ['Reports', 'reporting/report_runs', 'list-row'],
-    seed: async (h) => { await h({ m: 'POST', p: '/v1/reporting/report_runs', b: 'parameters[report_type]=balance.summary.1' }); },
+    seed: async (h) => { await h({ m: 'POST', p: '/v1/reporting/report_runs', b: 'report_type=balance.summary.1' }); },
     check: async ({ get }) => {
       const rows = ((await get('/v1/reporting/report_runs')).data as Body[]) as unknown as StripeRow[];
       if (!rows || rows.length < 1) return false;
@@ -2482,7 +3691,7 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
   done('stripe.ui.settings', 'ui-dashboard', 'Dashboard: Settings (account/team/api keys/webhooks)', 'ui', 'common', uiDataCoupled({
     markers: ['settings-block', 'data-settings', 'API keys', 'settings-payout-schedule', 'payoutScheduleText'],
     seed: async (h) => {
-      await h({ m: 'POST', p: '/v1/account', b: 'settings[payouts][schedule][interval]=weekly&settings[payouts][schedule][weekly_anchor]=monday' });
+      await h({ m: 'POST', p: '/_twin/account', b: 'settings[payouts][schedule][interval]=weekly&settings[payouts][schedule][weekly_anchor]=monday' });
       await h({ m: 'POST', p: '/v1/webhook_endpoints', b: 'url=https://twin.test/hook&enabled_events[]=charge.succeeded' });
     },
     check: async ({ get }) => {
@@ -2583,15 +3792,26 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
   ),
 
   // ── Refund cancel ──
-  done('stripe.refunds.cancel', 'refunds', 'Refunds: cancel a pending refund (400 if not pending)', 'api', 'niche', () =>
-    withRoot(async (h) => {
-      const pending = await h({ m: 'POST', p: '/v1/refunds', b: 'amount=500&currency=usd&status=pending' });
-      if (!ok(pending)) return false;
-      const x = await h({ m: 'POST', p: `/v1/refunds/${id(pending)}/cancel` });
-      const succeeded = await h({ m: 'POST', p: '/v1/refunds', b: 'amount=500&currency=usd' });
-      const bad = await h({ m: 'POST', p: `/v1/refunds/${id(succeeded)}/cancel` });
+  // A bank-transfer payment's refund waits in requires_action for the customer's bank details (Stripe emails them), and
+  // only such a refund can be canceled, which gives the charge back its amount; a succeeded refund cannot be canceled
+  // (docs.stripe.com/payments/customer-balance/refunding, docs.stripe.com/api/refunds/cancel).
+  done('stripe.refunds.cancel', 'refunds', 'Refunds: a bank-transfer refund awaiting bank details is canceled (400 once succeeded)', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      const cust = await h({ m: 'POST', p: '/v1/customers', b: 'email=wire@twin.test' });
+      await h({ m: 'POST', p: `/v1/test_helpers/customers/${id(cust)}/fund_cash_balance`, b: 'amount=2000&currency=usd' });
+      const pi = await h({ m: 'POST', p: '/v1/payment_intents', b: `amount=2000&currency=usd&customer=${id(cust)}&allowed_payment_method_types[]=customer_balance` });
+      await h({ m: 'POST', p: `/v1/payment_intents/${id(pi)}/apply_customer_balance` });
+      const waiting = await h({ m: 'POST', p: '/v1/refunds', b: `payment_intent=${id(pi)}&amount=500&instructions_email=wire@twin.test` });
+      if (!ok(waiting) || field(waiting, 'status') !== 'requires_action') return false;
+      const charge = String(field(waiting, 'charge'));
+      const held = await h({ m: 'GET', p: `/v1/charges/${charge}` });
+      const x = await h({ m: 'POST', p: `/v1/refunds/${id(waiting)}/cancel` });
+      const released = await h({ m: 'GET', p: `/v1/charges/${charge}` });
+      const back = await h({ m: 'POST', p: '/v1/refunds', b: `payment_intent=${id(pi)}&amount=500&origin=customer_balance` });
+      const bad = await h({ m: 'POST', p: `/v1/refunds/${id(back)}/cancel` });
       const miss = await h({ m: 'POST', p: '/v1/refunds/re_nope/cancel' });
-      return ok(x) && field(x, 'status') === 'canceled' && bad.status === 400 && miss.status === 404;
+      return ok(x) && field(x, 'status') === 'canceled' && field(back, 'status') === 'succeeded' && bad.status === 400 && miss.status === 404
+        && field(held, 'amount_refunded') === 500 && field(released, 'amount_refunded') === 0;
     }),
   ),
 
@@ -2604,7 +3824,12 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       const inc = await h({ m: 'POST', p: `/v1/payment_intents/${id(pi)}/increment_authorization`, b: 'amount=1500' });
       // must be greater than current → reject lowering
       const bad = await h({ m: 'POST', p: `/v1/payment_intents/${id(pi)}/increment_authorization`, b: 'amount=1000' });
-      return ok(inc) && field(inc, 'amount') === 1500 && field(inc, 'amount_capturable') === 1500 && field(inc, 'status') === 'requires_capture' && bad.status === 400;
+      // the charge holds the grown authorization, so capturing all of it releases nothing
+      const held = await h({ m: 'GET', p: `/v1/charges/${String(field(inc, 'latest_charge'))}` });
+      await h({ m: 'POST', p: `/v1/payment_intents/${id(pi)}/capture` });
+      const taken = await h({ m: 'GET', p: `/v1/charges/${String(field(inc, 'latest_charge'))}` });
+      return ok(inc) && field(inc, 'amount') === 1500 && field(inc, 'amount_capturable') === 1500 && field(inc, 'status') === 'requires_capture' && bad.status === 400
+        && field(held, 'amount') === 1500 && field(taken, 'amount_captured') === 1500 && field(taken, 'amount_refunded') === 0 && field(taken, 'refunded') === false;
     }),
   ),
 
@@ -2674,8 +3899,8 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
   // ── Connect: transfer reversals ──
   done('stripe.connect.transfer_reversals', 'connect', 'Connect: transfer reversals (partial + full)', 'api', 'niche', () =>
     withRoot(async (h) => {
-      const acct = await h({ m: 'POST', p: '/v1/accounts', b: 'type=standard' });
-      const tr = await h({ m: 'POST', p: '/v1/transfers', b: `amount=1000&currency=usd&destination=${id(acct)}` });
+      const seller = await onboardedSeller(h);
+      const tr = await h({ m: 'POST', p: '/v1/transfers', b: `amount=1000&currency=usd&destination=${seller}` });
       if (!ok(tr)) return false;
       const rev1 = await h({ m: 'POST', p: `/v1/transfers/${id(tr)}/reversals`, b: 'amount=400' });
       if (!ok(rev1) || field(rev1, 'object') !== 'transfer_reversal') return false;
@@ -2692,8 +3917,11 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
   // ── Connect: application fees + refunds ──
   done('stripe.connect.application_fees', 'connect', 'Connect: application fees + fee refunds', 'api', 'niche', () =>
     withRoot(async (h) => {
-      const fee = await h({ m: 'POST', p: '/v1/application_fees', b: 'amount=1000&currency=usd&charge=ch_twin_1&account=acct_1' });
-      if (!ok(fee) || field(fee, 'object') !== 'application_fee') return false;
+      // a destination charge with an application fee earns the platform its fee
+      const acct = await h({ m: 'POST', p: '/v1/accounts', b: 'type=express&country=US' });
+      await h({ m: 'POST', p: '/v1/charges', b: `amount=5000&currency=usd&source=tok_visa&application_fee_amount=1000&transfer_data[destination]=${id(acct)}` });
+      const fee = { status: 200, body: (((await h({ m: 'GET', p: '/v1/application_fees' })).body as Body).data as Body[])[0]! } as StripeResponse;
+      if (!fee.body || field(fee, 'object') !== 'application_fee' || field(fee, 'amount') !== 1000) return false;
       const g = await h({ m: 'GET', p: `/v1/application_fees/${id(fee)}` });
       const l = await h({ m: 'GET', p: '/v1/application_fees' });
       const ref = await h({ m: 'POST', p: `/v1/application_fees/${id(fee)}/refunds`, b: 'amount=400' });
@@ -2706,11 +3934,11 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
   // ── Files (uploads) + retrieve ──
   done('stripe.files.upload', 'files', 'Files: upload (purpose required) + retrieve/list', 'api', 'niche', () =>
     withRoot(async (h) => {
-      const f = await h({ m: 'POST', p: '/v1/files', b: 'purpose=dispute_evidence&filename=evidence.png' });
+      const f = await h({ m: 'POST', p: '/v1/files', b: 'purpose=dispute_evidence&file=evidence.png' });
       if (!ok(f) || field(f, 'object') !== 'file' || field(f, 'purpose') !== 'dispute_evidence') return false;
       const g = await h({ m: 'GET', p: `/v1/files/${id(f)}` });
       const l = await h({ m: 'GET', p: '/v1/files' });
-      const bad = await h({ m: 'POST', p: '/v1/files', b: 'filename=x.png' });
+      const bad = await h({ m: 'POST', p: '/v1/files', b: 'file=x.png' });
       return ok(g) && id(g) === id(f) && field(l, 'object') === 'list' && bad.status === 400;
     }),
   ),
@@ -2772,7 +4000,7 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       const cust = await h({ m: 'POST', p: '/v1/customers', b: 'email=acb@twin.test' });
       // partial funds first.
       await h({ m: 'POST', p: `/v1/customers/${id(cust)}/cash_balance_transactions`, b: 'amount=600&currency=usd' });
-      const pi = await h({ m: 'POST', p: '/v1/payment_intents', b: `amount=1000&currency=usd&customer=${id(cust)}&payment_method_types[]=customer_balance` });
+      const pi = await h({ m: 'POST', p: '/v1/payment_intents', b: `amount=1000&currency=usd&customer=${id(cust)}&allowed_payment_method_types[]=customer_balance` });
       if (!ok(pi)) return false;
       const partial = await h({ m: 'POST', p: `/v1/payment_intents/${id(pi)}/apply_customer_balance` });
       if (!ok(partial) || field(partial, 'status') !== 'requires_action') return false;
@@ -2795,7 +4023,7 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
   // + the amount-match check are produced ONLY by this feature.)
   done('stripe.payment_intents.verify_microdeposits', 'payment_intents', 'PaymentIntents: verify_microdeposits (ACH)', 'api', 'common', () =>
     withRoot(async (h) => {
-      const pi = await h({ m: 'POST', p: '/v1/payment_intents', b: 'amount=5000&currency=usd&payment_method_types[]=us_bank_account' });
+      const pi = await h({ m: 'POST', p: '/v1/payment_intents', b: 'amount=5000&currency=usd&allowed_payment_method_types[]=us_bank_account' });
       if (!ok(pi)) return false;
       const conf = await h({ m: 'POST', p: `/v1/payment_intents/${id(pi)}/confirm`, b: 'payment_method=pm_us_bank_account' });
       if (!ok(conf) || field(conf, 'status') !== 'requires_action') return false;
@@ -2817,7 +4045,7 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
   // wrong descriptor 400s. (the requires_action microdeposit state is produced ONLY by this feature.)
   done('stripe.setup_intents.verify_microdeposits', 'payment_methods', 'SetupIntents: verify_microdeposits (ACH)', 'api', 'common', () =>
     withRoot(async (h) => {
-      const si = await h({ m: 'POST', p: '/v1/setup_intents', b: 'payment_method_types[]=us_bank_account' });
+      const si = await h({ m: 'POST', p: '/v1/setup_intents', b: 'allowed_payment_method_types[]=us_bank_account' });
       if (!ok(si)) return false;
       const conf = await h({ m: 'POST', p: `/v1/setup_intents/${id(si)}/confirm`, b: 'payment_method=pm_us_bank_account' });
       if (!ok(conf) || field(conf, 'status') !== 'requires_action' || (field(conf, 'next_action') as Body)?.type !== 'verify_with_microdeposits') return false;
@@ -2957,7 +4185,7 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       // editing a finalized (non-draft) invoice 400s; missing lines 400; unknown invoice 404.
       await h({ m: 'POST', p: `/v1/invoices/${id(inv)}/finalize` });
       const afterFinal = await h({ m: 'POST', p: `/v1/invoices/${id(inv)}/add_lines`, b: 'lines[0][amount]=100' });
-      const noLines = await h({ m: 'POST', p: `/v1/invoices/${id(inv)}/add_lines`, b: 'metadata[x]=1' });
+      const noLines = await h({ m: 'POST', p: `/v1/invoices/${id(inv)}/add_lines`, b: 'invoice_metadata[x]=1' });
       const missing = await h({ m: 'GET', p: '/v1/invoices/in_nope/lines' });
       return afterFinal.status === 400 && (noLines.status === 400) && missing.status === 404;
     }),
@@ -3064,12 +4292,14 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       const e1 = await h({ m: 'POST', p: '/v1/billing/meter_events', b: `event_name=api_request&timestamp=100&payload[value]=3&payload[stripe_customer_id]=${id(cust)}` });
       const e2 = await h({ m: 'POST', p: '/v1/billing/meter_events', b: `event_name=api_request&timestamp=200&payload[value]=4&payload[stripe_customer_id]=${id(cust)}` });
       if (!ok(e1) || !ok(e2) || field(e1, 'object') !== 'billing.meter_event') return false;
-      const summary = await h({ m: 'GET', p: `/v1/billing/meters/${id(m)}/event_summaries?customer=${id(cust)}&start_time=0&end_time=1000` });
+      const summary = await h({ m: 'GET', p: `/v1/billing/meters/${id(m)}/event_summaries?customer=${id(cust)}&start_time=0&end_time=1020` });
       const sData = (summary.body as Body).data as Body[];
       if (!ok(summary) || sData[0]!.aggregated_value !== 7) return false;
       // an out-of-window event is excluded.
-      const summaryNarrow = await h({ m: 'GET', p: `/v1/billing/meters/${id(m)}/event_summaries?customer=${id(cust)}&start_time=150&end_time=1000` });
+      const summaryNarrow = await h({ m: 'GET', p: `/v1/billing/meters/${id(m)}/event_summaries?customer=${id(cust)}&start_time=120&end_time=1020` });
       if (((summaryNarrow.body as Body).data as Body[])[0]!.aggregated_value !== 4) return false;
+      // the window must be aligned with minute boundaries
+      if ((await h({ m: 'GET', p: `/v1/billing/meters/${id(m)}/event_summaries?customer=${id(cust)}&start_time=150&end_time=1020` })).status !== 400) return false;
       // deactivate → inactive; the active filter excludes it; reactivate → active.
       const off = await h({ m: 'POST', p: `/v1/billing/meters/${id(m)}/deactivate` });
       if (!ok(off) || field(off, 'status') !== 'inactive' || (field(off, 'status_transitions') as Body).deactivated_at === null) return false;
@@ -3088,7 +4318,7 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
   done('stripe.billing.alerts', 'billing', 'Billing usage alerts (thresholds)', 'api', 'niche', () =>
     withRoot(async (h) => {
       const m = await h({ m: 'POST', p: '/v1/billing/meters', b: 'display_name=Calls&event_name=calls&default_aggregation[formula]=count' });
-      const a = await h({ m: 'POST', p: `/v1/billing/alerts`, b: `alert_type=usage_threshold&title=Heavy use&usage_threshold[gte]=100&usage_threshold[meter]=${id(m)}` });
+      const a = await h({ m: 'POST', p: `/v1/billing/alerts`, b: `alert_type=usage_threshold&title=Heavy use&usage_threshold[gte]=100&usage_threshold[meter]=${id(m)}&usage_threshold[recurrence]=one_time` });
       if (!ok(a) || field(a, 'object') !== 'billing.alert' || field(a, 'status') !== 'active') return false;
       if ((field(a, 'usage_threshold') as Body).gte !== 100) return false;
       const get = await h({ m: 'GET', p: `/v1/billing/alerts/${id(a)}` });
@@ -3100,7 +4330,7 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       const arch = await h({ m: 'POST', p: `/v1/billing/alerts/${id(a)}/archive` });
       // vendor errors.
       const badType = await h({ m: 'POST', p: '/v1/billing/alerts', b: 'alert_type=bogus&title=x&usage_threshold[gte]=1&usage_threshold[meter]=' + id(m) });
-      const badMeter = await h({ m: 'POST', p: '/v1/billing/alerts', b: 'alert_type=usage_threshold&title=x&usage_threshold[gte]=1&usage_threshold[meter]=mtr_nope' });
+      const badMeter = await h({ m: 'POST', p: '/v1/billing/alerts', b: 'alert_type=usage_threshold&title=x&usage_threshold[gte]=1&usage_threshold[meter]=mtr_nope&usage_threshold[recurrence]=one_time' });
       const missing = await h({ m: 'GET', p: '/v1/billing/alerts/alert_nope' });
       return ok(on) && field(on, 'status') === 'active' && ok(arch) && field(arch, 'status') === 'archived' &&
         badType.status === 400 && badMeter.status === 400 && missing.status === 404;
@@ -3155,8 +4385,9 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       // before subscribing: no active entitlements.
       const before = await h({ m: 'GET', p: `/v1/entitlements/active_entitlements?customer=${id(cust)}` });
       if (!ok(before) || ((before.body as Body).data as Body[]).length !== 0) return false;
-      // subscribe → entitled to the product's feature.
-      const sub = await h({ m: 'POST', p: '/v1/subscriptions', b: `customer=${id(cust)}&items[0][price]=${id(price)}` });
+      // subscribe (the card pays the first invoice) → entitled to the product's feature.
+      const card = await h({ m: 'POST', p: '/v1/payment_methods/pm_card_visa/attach', b: `customer=${id(cust)}` });
+      const sub = await h({ m: 'POST', p: '/v1/subscriptions', b: `customer=${id(cust)}&items[0][price]=${id(price)}&default_payment_method=${id(card)}` });
       if (!ok(sub)) return false;
       const after = await h({ m: 'GET', p: `/v1/entitlements/active_entitlements?customer=${id(cust)}` });
       const data = (after.body as Body).data as Body[];
@@ -3243,25 +4474,19 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
         ok(li) && ((li.body as Body).data as Body[]).length === 1;
     }),
   ),
-  // Discount delete: attach a coupon to a customer (materializes the discount object) and to a
-  // subscription, then DELETE …/discount on each removes it (→ {object:'discount',deleted:true})
-  // and the resource's discount is cleared. Unknown customer 404. (the customer discount apply +
-  // both deletes are produced ONLY by this feature.)
-  done('stripe.discounts.delete', 'discounts', 'Customer/Subscription discount delete', 'api', 'common', () =>
+  // Discount delete: a subscription's coupon (discounts[0][coupon]) is removed by DELETE …/discount
+  // (→ {object:'discount',deleted:true}) and the subscription's discounts are cleared. A customer's discount has no
+  // create parameter in the served version (the customer-level coupon was removed), so an unknown customer's DELETE
+  // answers 404.
+  done('stripe.discounts.delete', 'discounts', 'Subscription discount delete', 'api', 'common', () =>
     withRoot(async (h) => {
       const coupon = await h({ m: 'POST', p: '/v1/coupons', b: 'percent_off=20&duration=forever' });
-      const cust = await h({ m: 'POST', p: '/v1/customers', b: `email=disc-del@twin.test&coupon=${id(coupon)}` });
-      if (!ok(cust) || (field(cust, 'discount') as Body)?.object !== 'discount') return false;
-      const delCust = await h({ m: 'DELETE', p: `/v1/customers/${id(cust)}/discount` });
-      if (!ok(delCust) || field(delCust, 'deleted') !== true) return false;
-      const c = await h({ m: 'GET', p: `/v1/customers/${id(cust)}` });
-      if (field(c, 'discount') !== null) return false;
-      // subscription discount delete.
-      const sub = await h({ m: 'POST', p: '/v1/subscriptions', b: `customer=${id(cust)}&coupon=${id(coupon)}` });
+      const cust = await h({ m: 'POST', p: '/v1/customers', b: 'email=disc-del@twin.test' });
+      const sub = await h({ m: 'POST', p: '/v1/subscriptions', b: `customer=${id(cust)}&discounts[0][coupon]=${id(coupon)}` });
       if (((field(sub, 'discounts') as Body[]) ?? []).length !== 1) return false;
       const delSub = await h({ m: 'DELETE', p: `/v1/subscriptions/${id(sub)}/discount` });
       const s = await h({ m: 'GET', p: `/v1/subscriptions/${id(sub)}` });
-      const badCoupon = await h({ m: 'POST', p: '/v1/customers', b: 'email=x@x.co&coupon=coupon_nope' });
+      const badCoupon = await h({ m: 'POST', p: '/v1/subscriptions', b: `customer=${id(cust)}&discounts[0][coupon]=coupon_nope` });
       const missing = await h({ m: 'DELETE', p: '/v1/customers/cus_nope/discount' });
       return ok(delSub) && field(delSub, 'deleted') === true && ((field(s, 'discounts') as Body[]) ?? []).length === 0 &&
         badCoupon.status === 400 && missing.status === 404;
@@ -3272,7 +4497,7 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
   done('stripe.promotion_codes.update', 'discounts', 'Promotion codes: update (active toggle)', 'api', 'common', () =>
     withRoot(async (h) => {
       const coupon = await h({ m: 'POST', p: '/v1/coupons', b: 'percent_off=10&duration=once' });
-      const pc = await h({ m: 'POST', p: '/v1/promotion_codes', b: `coupon=${id(coupon)}&code=UPD10` });
+      const pc = await h({ m: 'POST', p: '/v1/promotion_codes', b: `promotion[type]=coupon&promotion[coupon]=${id(coupon)}&code=UPD10` });
       if (!ok(pc) || field(pc, 'active') !== true) return false;
       const off = await h({ m: 'POST', p: `/v1/promotion_codes/${id(pc)}`, b: 'active=false&metadata[campaign]=spring' });
       if (!ok(off) || field(off, 'active') !== false || ((field(off, 'metadata') as Body)?.campaign) !== 'spring') return false;
@@ -3333,15 +4558,14 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       const missing = await h({ m: 'GET', p: '/v1/issuing/tokens/iss_tok_nope' });
       const badUpd = await h({ m: 'POST', p: '/v1/issuing/tokens/iss_tok_nope', b: 'status=active' });
       if (missing.status !== 404 || badUpd.status !== 404) return false;
-      // seed: a token is network-minted for a real card (no public create) via test_helpers.
+      // a token is network-minted when the cardholder adds a real card to a phone's wallet (the twin's stand-in).
       const ch = await h({ m: 'POST', p: '/v1/issuing/cardholders', b: 'name=Jane&type=individual&billing[address][country]=US' });
       const card = await h({ m: 'POST', p: '/v1/issuing/cards', b: `cardholder=${id(ch)}&currency=usd&type=virtual` });
-      const seeded = await h({ m: 'POST', p: '/v1/test_helpers/issuing/tokens', b: `card=${id(card)}` });
+      const seeded = await h({ m: 'POST', p: `/_twin/issuing/cards/${id(card)}/wallets`, b: 'wallet_provider=apple_pay' });
       if (!ok(seeded) || field(seeded, 'object') !== 'issuing.token' || field(seeded, 'status') !== 'active' || field(seeded, 'card') !== id(card)) return false;
       // minting requires a real card.
-      const badCard = await h({ m: 'POST', p: '/v1/test_helpers/issuing/tokens', b: 'card=ic_nope' });
-      const noCard = await h({ m: 'POST', p: '/v1/test_helpers/issuing/tokens' });
-      if (badCard.status !== 400 || noCard.status !== 400) return false;
+      const badCard = await h({ m: 'POST', p: '/_twin/issuing/cards/ic_nope/wallets', b: 'wallet_provider=apple_pay' });
+      if (badCard.status !== 400) return false;
       // retrieve the seeded token.
       const get = await h({ m: 'GET', p: `/v1/issuing/tokens/${id(seeded)}` });
       if (!ok(get) || id(get) !== id(seeded) || field(get, 'card') !== id(card) || field(get, 'status') !== 'active') return false;
@@ -3373,8 +4597,12 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
   // (the design object + review status machine are produced ONLY by this feature.)
   done('stripe.issuing.personalization_designs', 'issuing', 'Issuing: card personalization designs', 'api', 'niche', () =>
     withRoot(async (h) => {
-      const d = await h({ m: 'POST', p: '/v1/issuing/personalization_designs', b: 'physical_bundle=ipb_test&name=Gold card' });
-      if (!ok(d) || field(d, 'object') !== 'issuing.personalization_design' || field(d, 'status') !== 'inactive') return false;
+      // the card logo must be a file of purpose issuing_logo; another purpose is refused
+      const logo = await h({ m: 'POST', p: '/v1/files', b: 'purpose=issuing_logo&file=logo.png' });
+      const icon = await h({ m: 'POST', p: '/v1/files', b: 'purpose=business_logo&file=icon.png' });
+      if ((await h({ m: 'POST', p: '/v1/issuing/personalization_designs', b: `physical_bundle=ics_NLuXJPDYSTjFON&card_logo=${id(icon)}` })).status !== 400) return false;
+      const d = await h({ m: 'POST', p: '/v1/issuing/personalization_designs', b: `physical_bundle=ics_NLuXJPDYSTjFON&name=Gold card&card_logo=${id(logo)}` });
+      if (!ok(d) || field(d, 'object') !== 'issuing.personalization_design' || field(d, 'status') !== 'review') return false;
       const get = await h({ m: 'GET', p: `/v1/issuing/personalization_designs/${id(d)}` });
       const upd = await h({ m: 'POST', p: `/v1/issuing/personalization_designs/${id(d)}`, b: 'name=Platinum' });
       if (!ok(get) || !ok(upd) || field(upd, 'name') !== 'Platinum') return false;
@@ -3489,20 +4717,27 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
         badFa.status === 400 && noDest.status === 400 && nope.status === 404;
     }),
   ),
-  // Treasury InboundTransfers: pull funds into a FinancialAccount. create→succeeded (test-mode
-  // synchronous settle), posting a ledger Transaction (cash↑). Requires amount/currency/
-  // financial_account/origin_payment_method. Unknown id 404. id ibt_.
+  // Treasury InboundTransfers: pull funds into a FinancialAccount. create→processing (funds inbound_pending), the
+  // test helper's succeed→succeeded, posting its ledger Transaction (cash↑). Requires amount/currency/
+  // financial_account/origin_payment_method, a bank account set up for inbound flows and verified. Unknown id 404. id ibt_.
   done('stripe.treasury.inbound_transfers', 'treasury', 'Treasury: inbound transfers / received credits', 'api', 'niche', () =>
     withRoot(async (h) => {
       const fa = await h({ m: 'POST', p: '/v1/treasury/financial_accounts', b: 'supported_currencies[]=usd&features[inbound_transfers][requested]=true' });
-      const it = await h({ m: 'POST', p: `/v1/treasury/inbound_transfers`, b: `amount=3000&currency=usd&financial_account=${id(fa)}&origin_payment_method=pm_y` });
-      if (!ok(it) || field(it, 'object') !== 'treasury.inbound_transfer' || field(it, 'status') !== 'succeeded' || !id(it).startsWith('ibt_')) return false;
-      if ((field(it, 'status_transitions') as Body)?.succeeded_at == null) return false;
+      // the pulled account is set up for inbound flows and verified with a SetupIntent; one that is not is refused
+      const si = await h({ m: 'POST', p: '/v1/setup_intents', b: 'attach_to_self=true&flow_directions[]=inbound&allowed_payment_method_types[]=us_bank_account&payment_method_options[us_bank_account][verification_method]=microdeposits' });
+      const conf = await h({ m: 'POST', p: `/v1/setup_intents/${id(si)}/confirm`, b: 'payment_method_data[type]=us_bank_account&payment_method_data[us_bank_account][account_number]=000123456789&payment_method_data[us_bank_account][routing_number]=110000000&payment_method_data[us_bank_account][account_holder_type]=company&payment_method_data[billing_details][name]=Ops' });
+      const pm = String(field(conf, 'payment_method'));
+      if ((await h({ m: 'POST', p: `/v1/treasury/inbound_transfers`, b: `amount=3000&currency=usd&financial_account=${id(fa)}&origin_payment_method=${pm}` })).status !== 400) return false;
+      await h({ m: 'POST', p: `/v1/setup_intents/${id(si)}/verify_microdeposits`, b: 'amounts[]=32&amounts[]=45' });
+      const it = await h({ m: 'POST', p: `/v1/treasury/inbound_transfers`, b: `amount=3000&currency=usd&financial_account=${id(fa)}&origin_payment_method=${pm}` });
+      if (!ok(it) || field(it, 'object') !== 'treasury.inbound_transfer' || field(it, 'status') !== 'processing' || !id(it).startsWith('ibt_')) return false;
+      const done = await h({ m: 'POST', p: `/v1/test_helpers/treasury/inbound_transfers/${id(it)}/succeed` });
+      if (!ok(done) || field(done, 'status') !== 'succeeded' || (field(done, 'status_transitions') as Body)?.succeeded_at == null) return false;
       const get = await h({ m: 'GET', p: `/v1/treasury/inbound_transfers/${id(it)}` });
       const list = await h({ m: 'GET', p: `/v1/treasury/inbound_transfers?financial_account=${id(fa)}` });
       if (!ok(get) || ((list.body as Body).data as Body[]).length !== 1) return false;
       // a ledger transaction was posted with cash↑.
-      const txns = await h({ m: 'GET', p: `/v1/treasury/transactions?financial_account=${id(fa)}&flow_type=inbound_transfer` });
+      const txns = await h({ m: 'GET', p: `/v1/treasury/transactions?financial_account=${id(fa)}` });
       const tdata = (txns.body as Body).data as Body[];
       if (tdata.length !== 1 || (tdata[0]!.balance_impact as Body)?.cash !== 3000 || tdata[0]!.status !== 'posted') return false;
       // received_credits/debits read surface exists (empty until a test flow materializes one).
@@ -3513,7 +4748,7 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
     }),
   ),
   // Climate (carbon removal): products/suppliers catalog (read-only) + orders. An order needs
-  // a valid product + exactly one of amount/metric_tons (else 400); starts awaiting_funds;
+  // a valid product + exactly one of amount/metric_tons (else 400); is confirmed when made;
   // cancel→canceled. amount_total = subtotal+fees. Unknown product 400; unknown order 404.
   done('stripe.climate.orders', 'climate', 'Climate: orders / products / suppliers', 'api', 'niche', () =>
     withRoot(async (h) => {
@@ -3522,8 +4757,8 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       if (pdata.length === 0 || pdata[0]!.object !== 'climate.product') return false;
       const suppliers = await h({ m: 'GET', p: '/v1/climate/suppliers' });
       if (((suppliers.body as Body).data as Body[])[0]?.object !== 'climate.supplier') return false;
-      const order = await h({ m: 'POST', p: '/v1/climate/orders', b: 'product=climsku_direct_air_capture&metric_tons=2' });
-      if (!ok(order) || field(order, 'object') !== 'climate.order' || field(order, 'status') !== 'awaiting_funds' || !id(order).startsWith('climorder_')) return false;
+      const order = await h({ m: 'POST', p: '/v1/climate/orders', b: 'product=climsku_frontier_offtake_portfolio_2027&metric_tons=2' });
+      if (!ok(order) || field(order, 'object') !== 'climate.order' || field(order, 'status') !== 'confirmed' || !id(order).startsWith('climorder_')) return false;
       if (field(order, 'amount_total') !== (field(order, 'amount_subtotal') as number) + (field(order, 'amount_fees') as number)) return false;
       const get = await h({ m: 'GET', p: `/v1/climate/orders/${id(order)}` });
       const list = await h({ m: 'GET', p: '/v1/climate/orders' });
@@ -3531,25 +4766,27 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       const cancel = await h({ m: 'POST', p: `/v1/climate/orders/${id(order)}/cancel` });
       if (!ok(cancel) || field(cancel, 'status') !== 'canceled') return false;
       const badProduct = await h({ m: 'POST', p: '/v1/climate/orders', b: 'product=climsku_nope&metric_tons=1' });
-      const bothAmounts = await h({ m: 'POST', p: '/v1/climate/orders', b: 'product=climsku_direct_air_capture&metric_tons=1&amount=1000' });
+      const bothAmounts = await h({ m: 'POST', p: '/v1/climate/orders', b: 'product=climsku_frontier_offtake_portfolio_2027&metric_tons=1&amount=1000' });
       const nope = await h({ m: 'GET', p: '/v1/climate/orders/climorder_nope' });
       return badProduct.status === 400 && bothAmounts.status === 400 && nope.status === 404;
     }),
   ),
-  // Financial Connections: create a session (requires account_holder + permissions), link an
-  // account via the hosted-flow test helper, then read accounts + the session's accounts
-  // sub-list. id fcsess_ / fca_. Missing permissions 400; unknown id 404.
+  // Financial Connections: create a session (requires account_holder + permissions), the person links the test
+  // bank's accounts in the flow Stripe.js opens, then read accounts + the session's accounts sub-list. id fcsess_ /
+  // fca_. Missing permissions 400; unknown id 404.
   done('stripe.financial_connections.sessions', 'financial_connections', 'Financial Connections: sessions + accounts', 'api', 'niche', () =>
-    withRoot(async (h) => {
+    withRoot(async (h, root) => {
       const sess = await h({ m: 'POST', p: '/v1/financial_connections/sessions', b: 'account_holder[type]=customer&account_holder[customer]=cus_1&permissions[]=transactions&permissions[]=balances' });
       if (!ok(sess) || field(sess, 'object') !== 'financial_connections.session' || !id(sess).startsWith('fcsess_')) return false;
       if (typeof field(sess, 'client_secret') !== 'string') return false;
-      const acc = await h({ m: 'POST', p: `/v1/financial_connections/sessions/${id(sess)}/link_account` });
-      if (!ok(acc) || field(acc, 'object') !== 'financial_connections.account' || !id(acc).startsWith('fca_') || field(acc, 'status') !== 'active') return false;
+      await hostedSubmit(root, stripeFinancialConnectionsFlow, `https://js.stripe.com/v3/financial-connections/${String(field(sess, 'client_secret'))}`, { answer: 'link' });
       const getSess = await h({ m: 'GET', p: `/v1/financial_connections/sessions/${id(sess)}` });
-      if (((field(getSess, 'accounts') as Body)?.data as Body[]).length !== 1) return false;
+      const linked = ((field(getSess, 'accounts') as Body)?.data as Body[]) ?? [];
+      if (!linked.length) return false;
+      const acc = { status: 200, body: linked[0]! } as StripeResponse;
+      if (field(acc, 'object') !== 'financial_connections.account' || !id(acc).startsWith('fca_') || field(acc, 'status') !== 'active') return false;
       const accounts = await h({ m: 'GET', p: '/v1/financial_connections/accounts' });
-      if (((accounts.body as Body).data as Body[]).length !== 1) return false;
+      if (((accounts.body as Body).data as Body[]).length !== linked.length) return false;
       const getAcc = await h({ m: 'GET', p: `/v1/financial_connections/accounts/${id(acc)}` });
       const disc = await h({ m: 'POST', p: `/v1/financial_connections/accounts/${id(acc)}/disconnect` });
       const noPerms = await h({ m: 'POST', p: '/v1/financial_connections/sessions', b: 'account_holder[type]=customer&account_holder[customer]=cus_1' });
@@ -3557,20 +4794,17 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       return ok(getAcc) && ok(disc) && field(disc, 'status') === 'disconnected' && noPerms.status === 400 && nope.status === 404;
     }),
   ),
-  // Financial Connections account transactions: list a linked account's transactions
-  // (also via /v1/financial_connections/transactions?account=). Requires account; 404 unknown.
+  // Financial Connections transactions: a linked account's, listed by account. Requires account.
   done('stripe.financial_connections.transactions', 'financial_connections', 'Financial Connections: account transactions', 'api', 'niche', () =>
-    withRoot(async (h) => {
+    withRoot(async (h, root) => {
       const sess = await h({ m: 'POST', p: '/v1/financial_connections/sessions', b: 'account_holder[type]=customer&account_holder[customer]=cus_1&permissions[]=transactions' });
-      const acc = await h({ m: 'POST', p: `/v1/financial_connections/sessions/${id(sess)}/link_account` });
-      const txns = await h({ m: 'GET', p: `/v1/financial_connections/accounts/${id(acc)}/transactions` });
-      const tdata = (txns.body as Body).data as Body[];
-      if (tdata.length !== 2 || tdata[0]!.object !== 'financial_connections.transaction' || tdata[0]!.account !== id(acc)) return false;
-      const flat = await h({ m: 'GET', p: `/v1/financial_connections/transactions?account=${id(acc)}` });
-      if (((flat.body as Body).data as Body[]).length !== 2) return false;
+      await hostedSubmit(root, stripeFinancialConnectionsFlow, `https://js.stripe.com/v3/financial-connections/${String(field(sess, 'client_secret'))}`, { answer: 'link' });
+      const acc = ((field(await h({ m: 'GET', p: `/v1/financial_connections/sessions/${id(sess)}` }), 'accounts') as Body).data as Body[])[0]!;
+      const flat = await h({ m: 'GET', p: `/v1/financial_connections/transactions?account=${String(acc.id)}` });
+      const tdata = (flat.body as Body).data as Body[];
+      if (!tdata.length || tdata[0]!.object !== 'financial_connections.transaction' || tdata[0]!.account !== acc.id) return false;
       const noAcct = await h({ m: 'GET', p: '/v1/financial_connections/transactions' });
-      const nope = await h({ m: 'GET', p: '/v1/financial_connections/accounts/fca_nope/transactions' });
-      return noAcct.status === 400 && nope.status === 404;
+      return noAcct.status === 400;
     }),
   ),
   // Forwarding: PAN forwarding requests. create requires payment_method + url; stores the