feat(sca): emit abandoned_3ds_sweep_total counter from stale 3ds sweep

* feat(audit): emit cart_rejected event when per-order cap blocks checkout

* refactor(audit): drop dead persist call + harden cart_rejected test capture

api/handlers/cart.go

@@ -382,6 +382,7 @@ func (h *CartHandler) ConvertCart(w http.ResponseWriter, r *http.Request) {
 
 	if h.maxOrderCents > 0 && total > h.maxOrderCents {
 		middleware.RecordCartConversion("validation_over_limit")
+		audit.CartRejected(userID, total, h.maxOrderCents)
 		utils.RespondError(w, http.StatusBadRequest, "CART_OVER_LIMIT",
 			fmt.Sprintf("order total must be at most $%.2f", float64(h.maxOrderCents)/100),
 			map[string]any{

api/handlers/cart_test.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"encoding/json"
 	"fmt"
+	"log/slog"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -746,6 +747,19 @@ func TestConvertCartLimit(t *testing.T) {
 				t.Fatalf("SetCard: %d %s", w.Code, w.Body.String())
 			}
 
+			// Capture audit slog ONLY for ConvertCart's emit window. Placed
+			// here (not at top of t.Run) so setup INFO logs from
+			// database.Connect/Migrate/Seed don't pollute the buffer with
+			// non-audit records - json.Unmarshal below requires a single
+			// JSON object, not multi-document input. slog.Default is
+			// process-global - do NOT add t.Parallel() to subtests here.
+			var auditBuf bytes.Buffer
+			if tc.expectOverCap {
+				prev := slog.Default()
+				slog.SetDefault(slog.New(slog.NewJSONHandler(&auditBuf, nil)))
+				t.Cleanup(func() { slog.SetDefault(prev) })
+			}
+
 			// Convert
 			req = authRequest("POST", "/api/v1/cart/convert", nil, user.ID)
 			w = httptest.NewRecorder()
@@ -772,6 +786,27 @@ func TestConvertCartLimit(t *testing.T) {
 				if got, _ := resp.Error.Details["total_cents"].(float64); int(got) != tc.quantity*pinnedPrice {
 					t.Errorf("total_cents in details: want %d, got %v", tc.quantity*pinnedPrice, resp.Error.Details["total_cents"])
 				}
+
+				if auditBuf.Len() == 0 {
+					t.Fatalf("audit: expected cart_rejected slog line, got nothing")
+				}
+
+				var rec map[string]any
+				if err := json.Unmarshal(auditBuf.Bytes(), &rec); err != nil {
+					t.Fatalf("audit: decode slog record: %v\nraw: %s", err, auditBuf.String())
+				}
+				if got := rec["event"]; got != "cart_rejected" {
+					t.Errorf("audit event: want cart_rejected, got %v", got)
+				}
+				if n, _ := rec["user_id"].(float64); uint(n) != user.ID {
+					t.Errorf("audit user_id: want %d, got %v", user.ID, rec["user_id"])
+				}
+				if n, _ := rec["total_cents"].(float64); int(n) != tc.quantity*pinnedPrice {
+					t.Errorf("audit total_cents: want %d, got %v", tc.quantity*pinnedPrice, rec["total_cents"])
+				}
+				if n, _ := rec["cap_cents"].(float64); int(n) != tc.capCents {
+					t.Errorf("audit cap_cents: want %d, got %v", tc.capCents, rec["cap_cents"])
+				}
 			}
 		})
 	}

api/handlers/reconcile.go

@@ -5,6 +5,7 @@ import (
 	"log/slog"
 	"time"
 
+	"terminalShop/api/middleware"
 	"terminalShop/pkg/audit"
 	"terminalShop/pkg/database"
 	"terminalShop/pkg/models"
@@ -116,12 +117,14 @@ func ReconcileStale3DSOrders(threshold time.Duration) {
 			// one UPDATE so this should be unreachable; guard anyway so a
 			// future regression noisily logs instead of 4xx'ing Stripe.
 			reconcileLog().Warn("requires_action row missing PI id; skipping", "order_id", order.ID)
+			middleware.RecordAbandoned3DSSweep("missing_pi")
 			continue
 		}
 		actual, err := paymentIntentGetFn(order.StripePaymentID, nil)
 		if err != nil {
 			reconcileLog().Error("stripe get failed",
 				"order_id", order.ID, "pi", order.StripePaymentID, "error", err)
+			middleware.RecordAbandoned3DSSweep("stripe_error")
 			continue
 		}
 		switch actual.Status {
@@ -133,10 +136,12 @@ func ReconcileStale3DSOrders(threshold time.Duration) {
 			// tick re-checks and surfaces the dropped webhook if it persists
 			reconcileLog().Warn("stripe reports succeeded for requires_action row; deferring to webhook",
 				"order_id", order.ID, "pi", order.StripePaymentID)
+			middleware.RecordAbandoned3DSSweep("succeeded_skip")
 		case stripe.PaymentIntentStatusProcessing,
 			stripe.PaymentIntentStatusRequiresCapture:
 			reconcileLog().Info("payment intent still transitioning; skipping",
 				"order_id", order.ID, "pi", order.StripePaymentID, "stripe_status", string(actual.Status))
+			middleware.RecordAbandoned3DSSweep("processing_skip")
 		case stripe.PaymentIntentStatusRequiresAction,
 			stripe.PaymentIntentStatusRequiresPaymentMethod,
 			stripe.PaymentIntentStatusRequiresConfirmation,
@@ -145,6 +150,7 @@ func ReconcileStale3DSOrders(threshold time.Duration) {
 		default:
 			reconcileLog().Warn("unrecognized stripe status; skipping",
 				"order_id", order.ID, "pi", order.StripePaymentID, "stripe_status", string(actual.Status))
+			middleware.RecordAbandoned3DSSweep("unrecognized_status")
 		}
 	}
 }
@@ -162,16 +168,19 @@ func flipStale3DSToFailed(db *gorm.DB, order *models.Order, stripeStatus string)
 		Updates(map[string]any{"status": models.OrderStatusFailed})
 	if res.Error != nil {
 		reconcileLog().Error("flip stale 3ds failed", "order_id", order.ID, "error", res.Error)
+		middleware.RecordAbandoned3DSSweep("flip_failed")
 		return
 	}
 	if res.RowsAffected == 0 {
 		reconcileLog().Info("stale 3ds row already transitioned; sweep no-op",
 			"order_id", order.ID)
+		middleware.RecordAbandoned3DSSweep("flip_noop")
 		return
 	}
 	audit.Order3DSAbandoned(order.UserID, order.ID, order.StripePaymentID)
 	reconcileLog().Info("3ds abandoned order flipped to failed",
 		"order_id", order.ID, "pi", order.StripePaymentID, "stripe_status", stripeStatus)
+	middleware.RecordAbandoned3DSSweep("flipped")
 }
 
 // ReconcileExpiredCards removes saved cards whose retention deadline elapsed.

api/handlers/reconcile_test.go

@@ -6,11 +6,13 @@ import (
 	"testing"
 	"time"
 
-	"github.com/stripe/stripe-go/v78"
-
+	"terminalShop/api/middleware"
 	"terminalShop/pkg/audit"
 	"terminalShop/pkg/database"
 	"terminalShop/pkg/models"
+
+	"github.com/prometheus/client_golang/prometheus/testutil"
+	"github.com/stripe/stripe-go/v78"
 )
 
 // TestReconcileStale3DSOrders_FlipsAbandonedToFailed verifies the predicate
@@ -39,6 +41,9 @@ func TestReconcileStale3DSOrders_FlipsAbandonedToFailed(t *testing.T) {
 		}, nil
 	}
 
+	flipped := middleware.Abandoned3DSSweepCounter().WithLabelValues("flipped")
+	before := testutil.ToFloat64(flipped)
+
 	ReconcileStale3DSOrders(30 * time.Minute)
 
 	var reloaded models.Order
@@ -57,6 +62,9 @@ func TestReconcileStale3DSOrders_FlipsAbandonedToFailed(t *testing.T) {
 	if len(events) != 1 {
 		t.Fatalf("want 1 order_3ds_abandoned audit row, got %d", len(events))
 	}
+	if got := testutil.ToFloat64(flipped) - before; got != 1 {
+		t.Fatalf("want 1 flipped sweep counter increment, got %v", got)
+	}
 }
 
 // TestReconcileStale3DSOrders_SkipsRecent verifies the threshold predicate
@@ -124,6 +132,9 @@ func TestReconcileStale3DSOrders_SkipsWhenStripeSaysSucceeded(t *testing.T) {
 		}, nil
 	}
 
+	skip := middleware.Abandoned3DSSweepCounter().WithLabelValues("succeeded_skip")
+	before := testutil.ToFloat64(skip)
+
 	ReconcileStale3DSOrders(30 * time.Minute)
 
 	var reloaded models.Order
@@ -133,6 +144,9 @@ func TestReconcileStale3DSOrders_SkipsWhenStripeSaysSucceeded(t *testing.T) {
 	if reloaded.Status != models.OrderStatusRequiresAction {
 		t.Fatalf("must defer to webhook on succeeded; got %q", reloaded.Status)
 	}
+	if got := testutil.ToFloat64(skip) - before; got != 1 {
+		t.Fatalf("want 1 succeeded_skip sweep counter increment, got %v", got)
+	}
 }
 
 // TestReconcileStale3DSOrders_GuardsAgainstWebhookRace covers the conditional
@@ -161,6 +175,9 @@ func TestReconcileStale3DSOrders_GuardsAgainstWebhookRace(t *testing.T) {
 		}, nil
 	}
 
+	noop := middleware.Abandoned3DSSweepCounter().WithLabelValues("flip_noop")
+	before := testutil.ToFloat64(noop)
+
 	ReconcileStale3DSOrders(30 * time.Minute)
 
 	var reloaded models.Order
@@ -170,6 +187,9 @@ func TestReconcileStale3DSOrders_GuardsAgainstWebhookRace(t *testing.T) {
 	if reloaded.Status != models.OrderStatusPaid {
 		t.Fatalf("conditional update must preserve paid; got %q", reloaded.Status)
 	}
+	if got := testutil.ToFloat64(noop) - before; got != 1 {
+		t.Fatalf("want 1 flip_noop sweep counter increment, got %v", got)
+	}
 }
 
 // TestReconcileStale3DSOrders_FlipsCanceledPI covers the canceled-PI branch:
@@ -344,6 +364,9 @@ func TestReconcileStale3DSOrders_SkipsOnStripeError(t *testing.T) {
 		return nil, fmt.Errorf("simulated stripe outage")
 	}
 
+	stripeErr := middleware.Abandoned3DSSweepCounter().WithLabelValues("stripe_error")
+	before := testutil.ToFloat64(stripeErr)
+
 	ReconcileStale3DSOrders(30 * time.Minute)
 
 	var reloaded models.Order
@@ -353,6 +376,9 @@ func TestReconcileStale3DSOrders_SkipsOnStripeError(t *testing.T) {
 	if reloaded.Status != models.OrderStatusRequiresAction {
 		t.Fatalf("stripe error must not flip; got %q", reloaded.Status)
 	}
+	if got := testutil.ToFloat64(stripeErr) - before; got != 1 {
+		t.Fatalf("want 1 stripe_error sweep counter increment, got %v", got)
+	}
 }
 
 // TestReconcileStale3DSOrders_SkipsEmptyPaymentIntentID guards the

api/middleware/metrics.go

@@ -70,6 +70,14 @@ var (
 		[]string{"outcome"},
 	)
 
+	abandoned3DSSweepTotal = promauto.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: "abandoned_3ds_sweep_total",
+			Help: "ReconcileStale3DSOrders outcomes per row processed (flipped, flip_noop, flip_failed, succeeded_skip, processing_skip, stripe_error, missing_pi, unrecognized_status)",
+		},
+		[]string{"outcome"},
+	)
+
 	orderValueDollars = promauto.NewHistogram(
 		prometheus.HistogramOpts{
 			Name:    "order_value_dollars",
@@ -173,6 +181,19 @@ func ObserveOrderValueCents(cents int) {
 	orderValueDollars.Observe(float64(cents) / 100.0)
 }
 
+// RecordAbandoned3DSSweep records the outcome of one row processed by
+// ReconcileStale3DSOrders. Bounded enumeration documented on the counter's
+// Help string.
+func RecordAbandoned3DSSweep(outcome string) {
+	abandoned3DSSweepTotal.WithLabelValues(outcome).Inc()
+}
+
+// Abandoned3DSSweepCounter exposes the sweep counter so tests can snapshot
+// per-label values via prometheus testutil. Not used in production code.
+func Abandoned3DSSweepCounter() *prometheus.CounterVec {
+	return abandoned3DSSweepTotal
+}
+
 // ObserveStripeRequest records latency of a Stripe API call.
 func ObserveStripeRequest(op, outcome string, durSec float64) {
 	stripeRequestDuration.WithLabelValues(op, outcome).Observe(durSec)

go.mod

@@ -81,6 +81,7 @@ require (
 	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/klauspost/compress v1.18.0 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.10 // indirect
+	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.4.0 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect

pkg/audit/audit.go

@@ -24,6 +24,12 @@ const EventOrderRequiresAction = "order_requires_action"
 // stays decoupled from sweep activity
 const EventOrder3DSAbandoned = "order_3ds_abandoned"
 
+// EventCartRejected is the audit event-type string emitted when the per-order
+// spend cap blocks a checkout BEFORE an order row is created. The event lives
+// in slog only, persist() no-ops on zero order id, which is the correct shape
+// here (cap rejection is upstream of order state). See caveat #13.
+const EventCartRejected = "cart_rejected"
+
 type eventType string
 
 const (
@@ -36,6 +42,7 @@ const (
 	eventOrderFailed            eventType = "order_failed"
 	eventOrderRequiresAction    eventType = EventOrderRequiresAction
 	eventOrder3DSAbandoned      eventType = EventOrder3DSAbandoned
+	eventCartRejected           eventType = EventCartRejected
 	eventOrderRefunded          eventType = "order_refunded"
 	eventPaymentCritical        eventType = "payment_critical"
 	eventLabelPurchased         eventType = "label_purchased"
@@ -46,19 +53,21 @@ const (
 )
 
 type event struct {
-	Event     eventType
-	UserID    uint
-	OrderID   uint
-	CardID    uint
-	Amount    int
-	StripeID  string
-	CardLast4 string
-	CardBrand string
-	Carrier   string
-	Tracking  string
-	Status    string
-	Error     string
-	Actor     string
+	Event      eventType
+	UserID     uint
+	OrderID    uint
+	CardID     uint
+	Amount     int
+	StripeID   string
+	CardLast4  string
+	CardBrand  string
+	Carrier    string
+	Tracking   string
+	Status     string
+	Error      string
+	Actor      string
+	TotalCents int
+	CapCents   int
 }
 
 func (e event) attrs() []any {
@@ -99,6 +108,12 @@ func (e event) attrs() []any {
 	if e.Actor != "" {
 		a = append(a, "actor", e.Actor)
 	}
+	if e.TotalCents != 0 {
+		a = append(a, "total_cents", e.TotalCents)
+	}
+	if e.CapCents != 0 {
+		a = append(a, "cap_cents", e.CapCents)
+	}
 	return a
 }
 
@@ -349,3 +364,19 @@ func Order3DSAbandoned(userID, orderID uint, paymentIntentID string) {
 	slog.Info("audit", e.attrs()...)
 	persist(orderID, eventOrder3DSAbandoned, e)
 }
+
+// CartRejected records the per-order cap blocking a checkout BEFORE an
+// order row is created. Slog-only by design: cap rejection runs upstream
+// of order creation so there is no order id to scope a persistent
+// OrderEvent row. persist() is intentionally not called - future refactors
+// of the persist() zero-id guard must not silently start writing rows here.
+// Counterpart to the validation_over_limit Prometheus counter.
+func CartRejected(userID uint, totalCents, capCents int) {
+	e := event{
+		Event:      eventCartRejected,
+		UserID:     userID,
+		TotalCents: totalCents,
+		CapCents:   capCents,
+	}
+	slog.Info("audit", e.attrs()...)
+}

pkg/audit/audit_test.go

@@ -0,0 +1,41 @@
+package audit
+
+import (
+	"bytes"
+	"encoding/json"
+	"log/slog"
+	"strings"
+	"testing"
+)
+
+func TestCartRejected(t *testing.T) {
+	var buf bytes.Buffer
+	prev := slog.Default()
+	slog.SetDefault(slog.New(slog.NewJSONHandler(&buf, nil)))
+	t.Cleanup(func() { slog.SetDefault(prev) })
+
+	CartRejected(42, 25000, 20000)
+
+	raw := strings.TrimSpace(buf.String())
+	if raw == "" {
+		t.Fatalf("CartRejected: no slog output captured")
+	}
+
+	var rec map[string]any
+	if err := json.Unmarshal([]byte(raw), &rec); err != nil {
+		t.Fatalf("decode slog record: %v\nraw: %s", err, raw)
+	}
+
+	if got, want := rec["event"], "cart_rejected"; got != want {
+		t.Errorf("event: want %q, got %v", want, got)
+	}
+	if n, _ := rec["user_id"].(float64); int(n) != 42 {
+		t.Errorf("user_id want 42, got %v", rec["user_id"])
+	}
+	if n, _ := rec["total_cents"].(float64); int(n) != 25000 {
+		t.Errorf("total_cents: want 25000, got %v", rec["total_cents"])
+	}
+	if n, _ := rec["cap_cents"].(float64); int(n) != 20000 {
+		t.Errorf("cap_cents: want 20000, got %v", rec["cap_cents"])
+	}
+}

pkg/config/config.go

@@ -137,11 +137,13 @@ func getEnvOrDefault(key, defaultValue string) string {
 	return defaultValue
 }
 
-// loadMaxOrderCents reads MAX_ORDER_CENTS. Default $200. Explicit 0 disables
-// the cap. Garbage or negative values fall back to the default with a warning
-// so an operator typo cannot silently disable a fraud control.
+// loadMaxOrderCents reads MAX_ORDER_CENTS. Default $500 — aligns with the
+// PSD2 TRA exemption ceiling (above this, Stripe always requests SCA, so the
+// cap is only meaningful below it). Explicit 0 disables the cap. Garbage or
+// negative values fall back to the default with a warning so an operator
+// typo cannot silently disable a fraud control.
 func loadMaxOrderCents() int {
-	const defaultCap = 20000
+	const defaultCap = 50000
 	raw := os.Getenv("MAX_ORDER_CENTS")
 	if raw == "" {
 		return defaultCap

pkg/config/config_test.go

@@ -24,12 +24,12 @@ func TestLoadMaxOrderCents(t *testing.T) {
 		env  string // "" means unset
 		want int
 	}{
-		{"empty falls back to default", "", 20000},
+		{"empty falls back to default", "", 50000},
 		{"explicit zero disables", "0", 0},
-		{"valid override", "50000", 50000},
-		{"negative falls back to default", "-1", 20000},
-		{"garbage falls back to default", "two hundred", 20000},
-		{"empty after trim falls back to default", "", 20000},
+		{"valid override", "30000", 30000},
+		{"negative falls back to default", "-1", 50000},
+		{"garbage falls back to default", "two hundred", 50000},
+		{"empty after trim falls back to default", "", 50000},
 	}
 
 	for _, tc := range cases {