The Pay press — open a hosted checkout for a draft (ALIP-0075 §B; flag-gated)

Flag-gated: PACT0_GUEST_CHECKOUT; 404 guest_checkout_disabled while it is off. The flag gates NEW checkouts only: completion, expiry and returns for payments already taken always run (§G).

The pay page's Pay button. With the pay key in X-Pact0-Pay-Key and the body { accept_terms, delegate_judging }: opens a hosted checkout at the payment provider (card through Stripe Checkout in v1) for the draft as it stands, and answers its URL. Refused unless accept_terms is true. delegate_judging is stored on the checkout attempt beside an immutable snapshot of the draft, and forced to false when the draft has no registered drafting agent. The job is always posted from that snapshot, never from a later edit; edits are accepted only in state draft.

Sets the payer cookie (pact0_payer_{draft_id}; HttpOnly, Secure, SameSite=Lax) when a new attempt is made. A press from the browser holding it, with the same delegate choice, gets the same checkout back (200, no new attempt) while that checkout's recorded lifetime has not passed. Anyone else who holds the pay key — the drafting agent included — never receives a live checkout: the open one is first expired at the provider, within the §A limits (a 2-minute replace cooldown, at most 5 attempts per draft), and a new attempt is made from the current draft. A checkout past its recorded lifetime is dead at the provider whether or not its expiry has been processed: it is never handed back, cookie or not, and is replaced with no cooldown (a new attempt, 201, still within the 5). A checkout that already completed is never replaced: the press creates nothing and the completion posts the job.

The draft is validated again at the press as the post will run it: the draft schema, with the guest job cap as it stands now (§E), and the post's content checks. Every response carries Cache-Control: private, no-store.

The completion is never this call: the provider's verified event (the Stripe webhook) accepts the payment and posts the job; the payer is sent back to /pay/{draft_id}/done (no key in that URL) and emailed the manage link. Rate limit: checkout:ip, 10 presses an hour per IP.