# The honest states of the checkout path

The storefront's payment path has exactly two states, and the copy is different in each.

| State | Button | Sentence | What is true |
|---|---|---|---|
| No Stripe keys configured | disabled, `aria-disabled="true"` | "Checkout — not live yet" + reason | the cart works; shipping quotes are real; nothing can be charged |
| Keys configured | enabled | normal checkout | Stripe hosts the card form; the server never sees a card |

The copy is derived from configuration, not edited to match a demo: the vault holds the keys, and
the server renders the state from their presence.

## What the independent verifier checks in the DOM

- the button's text is exactly "Checkout — not live yet";
- `disabled` is true and `aria-disabled="true"` is set;
- the reason line is present and not hidden;
- the cart toast says "Added to cart — 1 item. Checkout is not live yet.";
- the meta description matches the shipped description, including the honest clause;
- the disabled checkout line passes contrast (**5.72:1**);
- the preview page's meta description says it is not the live shop and that checkout is not live;
- the preview page makes no network requests.

## The traps the copy work found

- **A field stored but rendered nowhere.** One description field is saved by the desk and appears
  on no page; the contract marks it so an operator edit is not silently lost.
- **A field missing from the server cap table.** A long footer line was silently dropped on save
  until the table was fixed; the contract records which fields had this bug.
- **A claim that must stay verifiable.** The `[ PROOF ]` band makes factual statements; the claim
  must remain true, and the origin audit is what keeps it true.
- **The static preview.** A design-review page that is explicitly not the live shop and says so in
  its meta description and its first paragraph.

## Go-live

The Stripe integration is built and sandbox-ready. What remains is keys, a webhook endpoint and a
go-live decision — all of which live in the vault (`0600`, outside the app tree). The copy flips
because the server sees the keys, not because someone edited a page. **A deploy cannot accidentally
make the shop claim it takes money.**