Production failure post-mortems and architectural playbooks on Stripe 2025-03-31.basil period normalization, Visa Compelling Evidence 3.0 routing, European Commission VIES HTTP 200 OK soft-failure circuit breakers, Shopify Plus B2B Net-15/30/60 integer-cent deposit reconciliation, and webhook HMAC-SHA256 raw-body pitfalls.
basil API broke my grace-period logic, and CE 3.0 turned out to be a routing problemWhy top-level current_period_end silently evaluates to false in 2025-03-31.basil, how multi-subscription customers trigger false lockouts, and why Visa 10.4 disputes require 2-tier routing with submit: false.
HTTP 200 when it's down, and I charged the wrong VAT because of itHow the European Commission VIES REST endpoint returns HTTP 200 OK with actionSucceed: false and MS_MAX_CONCURRENT_REQ during national database outages, plus prefix normalization across 27 EU member states + Northern Ireland (XI).
Net-30 fulfillment holdsWhy IEEE-754 floating-point math, partial SEPA bank wires, and post-invoice credit notes prematurely release Shopify Plus B2B fulfillmentOrders holds or over-collect on adjusted wholesale invoices.
JSON.stringify(req.body) breaks Stripe & Shopify webhook HMAC-SHA256 verificationHow framework JSON parsers mutate UTF-8 byte streams before HMAC calculation, why Shopify uses Base64 while Stripe signs t.payload in hex, and how to enforce a 300-second replay guard with crypto.timingSafeEqual.
$15k–$300k/yr in recovered revenueAn integer-cent unit-economics breakdown comparing percentage-of-recovery dispute agencies against flat-rate 0% commission Visa CE 3.0 & first-party usage-log staging (submit: false) plus automated ghost-usage revocation.
72h monotonic state machineWhy verifying Stripe-Signature or X-Shopify-Hmac-Sha256 is only half the battle: how delayed queue retries overwrite terminal canceled states, and how a 72-hour deduplication Set plus a monotonic createdSec >= lastTransitionTimestamp watermark eliminates state regressions.
MS_UNAVAILABLE Audit PlaybookHow EU VAT Directive 2006/112/EC Article 196 and Regulation (EU) No 282/2011 Article 18 govern intra-EU B2B reverse-charge evidence, why synchronous VIES calls abandon 14%–22% of checkouts during national maintenance windows, and how a 3-Tier Circuit Breaker seals SHA-256 consultation_proof_hash audit bundles.
18,000-character dispute evidence ceiling is measured in UTF-16 code units — and how naive automation overwrites AE notesHow surrogate pairs and UTF-8 vs. UTF-16 length mismatches trigger 400 parameter_invalid_string_length or truncate Visa Compelling Evidence 3.0 prior-charge tables, and how non-destructive delimiter blocks preserve human notes with submit: false.
| Diagnostic Utility | Protocol / Standard | Primary Guardrail | Direct Endpoint |
|---|---|---|---|
Stripe basil Entitlement Auditor |
Stripe API 2025-03-31.basil |
Item-level current_period_end aggregation & multi-subscription reconciliation |
/tools/stripe-basil-auditor |
| Visa CE 3.0 Readiness Checker | Visa 10.4 Compelling Evidence 3.0 | 120d–365d prior charge & IP/Device overlap + submit: false draft preview |
/tools/stripe-ce3-checker |
| EU & XI VIES Batch Validator | EC VIES REST API (28 VAT Prefixes) | Greece GR → EL normalization & HTTP 200 outage wrapper detection |
/tools/vies-vat-validator |
| Shopify B2B Net-Terms Calculator | Shopify Plus B2B Net-15/30/60 |
Integer EUR-cent 30% upfront deposit gate, credit-note deduction & hold release | /tools/b2b-net-terms-calculator |
| Webhook HMAC-SHA256 Signature Tester | Stripe-Signature / X-Shopify-Hmac-Sha256 / X-RevClamp-Signature |
Raw UTF-8 byte HMAC verification, 300s replay window & Zero-Trust live-secret guard | /tools/webhook-signature-tester |
| 0% Take-Rate ROI & Plan Calculator | Integer USD-Cent Margin & Plan-Fit Engine | Replaces 25%–30% contingency chargeback fees with flat-rate 0% commission plans | /tools/b2b-chargeback-roi-calculator |
| Webhook Replay & Out-of-Order Simulator | 72-Hour Deduplication & Monotonic Watermark FSM | Blocks delayed out-of-order updates from resurrecting canceled subscriptions |
/tools/webhook-replay-simulator |
| Dispute Evidence UTF-16 & CE 3.0 Linter | Stripe 18,000 UTF-16 Ceiling & Visa CE 3.0 Rubric |
Validates non-destructive delimiter blocks, UTF-16 code units, and submit: false |
/tools/stripe-dispute-evidence-char-counter |
| Next.js 12-Line Edge Guard | HMAC-SHA256 Signed Webhooks | Blocks unpaid API/LLM token bleed on 2025-03-31.basil subscriptions |
/docs/stripe-setup |
| Model Context Protocol (MCP) Server | JSON-RPC 2.0 Streamable HTTP | 9 B2B revenue, VAT, webhook, ROI & dispute-evidence tools (stateless sandbox or workspace key) | POST /api/mcp (spec) |
| Merchant Revenue Console | Self-Serve Workspace & CSV Vault | 5,000 events/mo free forever; flat monthly tiers with 0% dispute take-rate | /dashboard |