PRM01-T07 source checkpoint. No Play product, base plan, OAuth service credential, push subscription/audience, trusted Google signing-key lifecycle, or runtime encryption/account-binding key is configured. Current API/worker ports remain nil; no environment-only grant bypass exists. Real sandbox acceptance is PROOF_OWED by owner instruction.

Before payment-module integration: create the Android catalog for com.anpfuel; freeze supported product/base-plan/environment allowlists; establish least-privilege Developer API OAuth and Pub/Sub authenticated push identity/audience; provide distinct recoverable AES-GCM and HMAC keys outside Git/logs; prove key/JWKS rotation, revocation/outage and backup recovery. Revalidate official provider contracts at that integration. Source limits are not measured production admission; paid global admission remains zero.

Configured worker: once a minute, select at most 25 due indexed purchases, account then token lock, atomically enqueue digest-only canonical refresh and move due time five minutes. Missed notices are recovered without an unbounded scan; parallel workers converge. Failed enqueues roll back checkpoint. Queue lease/retry/dead status survives restart; canonical refresh always rechecks active owner, provider account/catalog and generation. Database failure logs only static event codes. Disabled provider does not run paid reconciliation; bounded receipt cleanup remains independent.

Operator database access is private, never a public grant endpoint. Read subscription-refresh/subscription-acknowledge queue totals/age with the existing queue stats port; monitor oldest overdue due time, dead count and redacted provider failure counters in the hosting telemetry. Do not log digests, owners, token envelopes or provider bodies. Replay only a reviewed DEAD job through Queue.ReplayDead with an audited static reason after fixing the cause; replay does not bypass live provider/owner/revision checks. Never copy a token into a CLI argument or manually update an ACTIVE Boolean.

Recovery: disable payment-module admission/scheduler, preserve free status/export/deletion/local records, fix provider/DB/key failure, bounded replay, verify canonical state and current generation. Forward migration only. Pending operation material is removed at 30 days; completed operation/provider receipts at 90 days, 100 per cleanup tick. Verified terminal purchase token/catalog metadata is removed after 90 days past verification and access end; active/unknown chains are preserved. Opaque retired-token ownership fences are separate minimal anti-replay metadata; their final owner-retention policy remains a payment-module/privacy obligation before sales.

Real sandbox matrix still OWED: purchase→ack, lost acknowledgement, pending→active, renewal/cancel/paid-through, grace/hold/pause/expiry, refund/revoke, linked replacement and old-token restore, wrong app account, unknown catalog/environment, missed notice/reconciliation, credential rotation/outage, restart/replay, stale restored DB and free exits. Local synthetic/TLS/PostGIS evidence never substitutes for these results. No deployment or billing activation is authorized by this runbook.

Restricted commands (existing operator/config environment, no token arguments): go run ./cmd/ops subscription stats --operator ; go run ./cmd/ops subscription replay --job --reason provider-fixed --operator . Replay reason is one of provider-fixed/db-fixed/key-rotated, and only DEAD subscription jobs are eligible. Printed output contains aggregate counts only.