Apply the Fable 5.1 max CLI review to the final checkpoint. Add the missing first-binding grant event in the same transaction as ownership, reject a premature expiry without consuming its observation, and verify both rollback and expiry boundaries. Correct test labels to describe what they exercise.
Repair patch generation without rewriting historical source or screenshots. Build patches from the preceding archived source and verify their hashes. Install and test each archive outside the monorepo with npm. Capture the revised final screen on desktop and mobile, then export only matching source evidence.
Keep the original six checkpoints as history. Explain their incomplete discovery and missing grant behavior; do not describe them as conformant providers. Keep all changes uncommitted for maintainer review.
Apply the second review: retain gate delivery state for delayed expiry, retain store occurrence on delayed binding, preserve consecutive failure logs, and state actual package contents and runtime requirements. Add a ready-to-run generic event receiver for an existing backend, reusing the same receiver handler. Demonstrate signed lifecycle ingestion, duplicate delivery, tampering, and persisted inbox recovery over real local HTTP. Keep all samples fictional.
Add composable integration roles: experience, commerce, and data. Ship a short AI integration brief and a backend helper that maps Apple/Google OpenIAP purchase fields into the installed verification schema. Test invalid inputs and exclude client-supplied identity. Keep paywall UI APIs product-specific, current IAPKit-only client helpers explicit, and store/device proof separate from local fixtures. Reuse the existing consumer and contract validators.
The first bridge test failed because store evidence was nested under an extra
evidence key. Keep the failure output, use the installed input schema's
top-level apple/google members, and rerun that boundary check.
Apply the third CLI review. Make the integration brief reachable from the docs site with absolute setup, source, and build-brief links. Accept signed webhook delivery behind a reverse proxy that preserves the public Host header. Keep unfinished captures from blocking completed history, retain equal-time fixture transitions, record the observed duplicate response, and configure Yarn's node-modules linker. Preserve the proxy failure and rerun the checks.
Prepare the standalone example for its first public commit. Rewrite the README around clone, run, inspect, choose a role, and verify. Put receiver and capture setup in repository documentation so the example works before the docs site is deployed. Preserve every earlier archive. Record this documentation revision, verify all source archives again, and export a stable current-source download. Add CI that tests runtime, tooling, archives and the documentation export. This revision is a local publication review, not another completed external review.
Fix the first Linux CI failure without rewriting historical recordings. macOS AppleDouble metadata must not count as source. Exclude it on extraction, omit it from new archives, and add a portable extraction regression test. Capture the corrected tooling, verify every source revision, and rerun GitHub CI.
Correct the final CLI review finding: exercise cancellation at the expiry observation timestamp so the check reaches the expired-state guard. Preserve the earlier capture, record this revision, and verify its archive and patch.
Apply the Codex review: authenticate webhook body bytes before UTF-8 decoding. Reject altered UTF-8 and inserted BOM bytes with an unchanged signature. Reject authentically signed malformed UTF-8 before storage, and accept correctly signed Unicode and BOM bodies. Keep the reproduced failure, preserve old checkpoints, then capture and verify the corrected revision.