Checkout sessions & price locking

Hosted checkout creates a server-side quote from the product ID. Quotes expire after 15 minutes and snapshot product version, fee policy, discounts and tax. A changed catalog version or fee policy invalidates an unconfirmed quote rather than silently accepting a stale price.

The hosted client creates an order after confirming the quoted total and supplies a random order capability. Its hash is stored; the capability is required for subsequent public order commands and expires after 24 hours. Keep capabilities private and out of logs. A product ID alone cannot read an order.

The external scoped API currently returns reusable links, not session objects. A first-class short-lived session API is planned. Do not invent a /checkout/sessions endpoint or send browser-provided price snapshots.

A frontend redirect is not settlement proof. Provider requests require verified callbacks and reconciliation before ledger posting; mock outcomes are explicit simulations. Timed-out provider sessions cannot be reused as active checkout.