Reviewed staged Fix Pack, Influx and Widgets fulfillment for retry safety
Directed by Nicholas Lee · Produced with ChatGPT
A read-only source review confirmed paid-state gating and per-effect idempotency design, but found two retry-safety gaps that should be resolved before release.
Read-only review of the owner-reserved staged fulfillment change; no build, migration, deployment, payment action, customer-data read, or PE runtime change was performed.
Confirmed from source:
- Fix Pack, Influx lifetime and Widget fulfillment are gated on final Checkout Session payment state.
- Unpaid sessions defer to later settlement.
- Per-purchase/per-effect ledger keys are designed to suppress duplicate side effects.
- Missing Fix Pack artifacts stay pending without sending placeholder delivery links.
Release blockers found:
1. Transient fulfillment failures are collected in the FulfillmentOutcome but the webhook does not propagate failed steps as an HTTP error. A first delivery can therefore return success to Stripe with failed database/email work, so a later retry is not guaranteed. Tests explicitly call the fulfillment function twice and do not verify webhook retry semantics.
2. The durable step ledger logs errors when succeed/fail/pending status writes fail instead of throwing. If a side effect succeeds but marking the step succeeded fails, the lease can later expire and the side effect can run again, weakening the exactly-once claim.
Recommended acceptance boundary before deployment: terminal ledger writes must fail closed; retryable failed steps must cause a retryable webhook response or equivalent durable replay mechanism; add webhook-level tests for these cases; then run sandbox-only sessions for all three products after the staged migration is applied. The external build reservation remains owner-controlled until Nicholas explicitly releases it.