Two pre-launch gaps.
1. Checkout collected no address, so Stripe Customers carried no
country. EU B2C digital-services VAT is due at the consumer's place
of supply and we can't even scope that question without knowing
where buyers are; the card's billing country is the evidence a tax
authority accepts, an IP guess is not. It also gives AVS data to the
fraud checks. Passing `customer` suppresses the write-back to the
Customer record, so existing customers also need
customer_update.address=auto — without it the country lands on the
PaymentIntent and nowhere durable.
2. A paused subscription kept paid features while Stripe billed
nothing. Both mechanisms were unhandled: status="paused" (trial
ended with no usable card) had no entry in _HANDLERS at all, and
`pause_collection` — what the customer portal's pause button uses —
leaves status as "active", so the status check waved it through.
Revoke on both, keeping stripe_subscription_id since the
subscription still exists at Stripe and resumes under the same id.
Pause is disabled in our live portal configuration, so (2) is latent
rather than live — but it's a one-toggle mistake away from being real.
Verified against live Stripe: a Checkout Session with the new params is
accepted (gbp 700, billing_address_collection=required, livemode), and
the live webhook endpoint already subscribes both paused and resumed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Giorgio Gilestro
78b2c2be28