# Paid-order verification

@requirements REQ-PRODUCT-PAID-ORDER-ARCHIVES REQ-EU-ORDER-ACTION REQ-EU-GUARANTEE-LABEL REQ-PRODUCT-SAFE-CONTENT REQ-PRODUCT-A11Y REQ-PRODUCT-MOBILE

The core tests exercise mixed goods/services, independent commitments, fixed total versus deposit/balance, finite recurring cycles, indefinite subscriptions, zero-initial later/conditional fees, calculated prices and exact localized money. They reject incomplete line coverage, inconsistent totals, changed quote/wording hashes, hostile JSON, getters, unsafe text, unresolved production guarantees, wrong product associations and changed original label bytes.

Controller tests cover concurrent/reentrant submission, observer exceptions, presentation checks at dispatch, quote expiry, host rejection, lost responses, retained recovery after expiry, incompatible contexts, mismatched outcomes, timeouts, late completion, destruction and request-ID allocation failure. DOM tests keep critical facts expanded, use the exact native payment label, block failed required images and changed facts/ARIA wording, and hide unavailable recovery actions. Client hashes and DOM checks are integrity measures, not proof of legal compliance or a substitute for host authorization.

Site tests cross the HTTP/session-DO boundary: independent visitors cannot access each other’s quotes or history; repeated requests create one retained admission; exact reviews and separate payment/contract/confirmation states appear in a searchable history. Direct host tests exercise expired/superseded quotes, idempotency before expiry checks, release changes and malformed/rebound requests. The example does not charge money or form contracts.

Primary research includes current CRD Article 8(2) and its Article 6(1)(a), (e), (la), (o), (p) references; full Conny judgment paragraphs 44–56 and the operative part; and indexed Fuhrmann-2 primary excerpts, including paragraphs 28 and 34. Complete Fuhrmann-2 retrieval remains open. These references are recorded in the requirements catalog, with legal review unreviewed.

Remaining: production wording/localization review; applicable national implementation; physical-device accessibility, guarantee and QR legibility; real host payment/stock admission tests; complete pre-contract disclosures and any early-performance/digital-content permissions; durable contract confirmation and delivery. Reusable Cloudflare order/asset archives and local atomic host mutation plans are now implemented; acceptance against a real commercial payment/stock system remains open. The regulatory requirement remains **partial**.

Chrome review on 19 October 2026 used an isolated local Worker with SQLite-backed demo storage. A desktop mixed-cart action reached its retained review; 390px admin and 320px dark conditional layouts had no horizontal page overflow (375px and 305px content widths). Keyboard Enter submitted the nonbinding conditional example, and focus moved to the received-status message. A narrow-header wrapping defect found during inspection was corrected. Screenshots were saved locally. This is Chromium QA, not physical-device, screen-reader or production legal acceptance.

The completed milestone passes 591 package tests and 75 site tests (666 total), catalog checks and the Worker deployment dry run. All 200 prior retained artifact files keep their recorded hashes. Packed authoring/React consumer declarations and a real isolated packed Astro build pass. Static order rendering measures 6.08 KiB gzip; the optional controller/view entry measures 8.56 KiB gzip. The pre-existing compatibility consent entry remains 19.84 KiB against its separate 15 KiB target; no change to that open budget item is claimed.

The final 320px deposit view kept €129 total, €29 due now and the complete payment button visible without horizontal overflow; its label image loaded without filtering. The received attempt was then recovered after stopping and restarting the isolated QA Worker over the same SQLite state. The returned receipt ID matched the original. New sample-order controls appear only after a structured confirmed outcome, never during uncertainty.

## Reusable Cloudflare archive and admission

`REQ-PRODUCT-PAID-ORDER-ARCHIVES` is an engineering requirement, separate from legal acceptance. Backend tests cover original-file chunks and corruption, complete reviews larger than a legacy KV value, a valid near-budget review, strict linked production-document checks, repeated descriptors sharing one file, quote CAS/supersession, competing nonces, one admission across intent revisions, exact retained outcomes, scoped local host plans, rollback, a clock advancing during host work, separate archive permissions, admission-bound image/download access, small export projections, legal holds and resumable retirement/restore fences. The authoring builder now checks its complete final output against the consumer's data budget.

The CF-only package test packs and installs `notabenda-cf` offline in a separate consumer with no frontend dependency. Runtime imports, an authorized-worker denial and strict TypeScript declarations pass. The generated backend validator/static renderer copies are checked against their frontend sources. CSS parsing compares every public review declaration and media condition with the admin copy; layers are unwrapped there so admin document defaults cannot shrink or otherwise override the review.

The website now calls the reusable archive/activation/admission APIs. HTTP/session tests cover private archives across visitors, atomic quote publication, expiry after awaited work, exact retry outcomes across template changes, nonce consumption, command-accounting interruption and pre-archive receipt recovery/inspection. The compatibility path issues no new legacy quotes.

On 19 October 2026, `node scripts/check-order-archive-runtime.mjs` passed against an isolated local SQLite Worker on port 4188. After stopping and restarting that owned process over the same state, `node scripts/check-order-archive-runtime.mjs --recover` returned the exact original receipt, canonical review and 308,145-byte producer file. It also checked sandboxed image headers, HEAD, cross-session denial and export exclusion. The script uses no operational admin credentials; its private demo recovery fixture stays under git-ignored `.local/`.

Chromium review covered desktop, 390px and 320px archive screens. Required original images loaded without filtering. Content widths were 375px and 305px on the two mobile viewports, with no page overflow. A narrow-header wrap and unlayered admin typography override found during review were corrected. These observations do not replace physical-device, screen-reader, artwork or production legal acceptance.