# Premium API, dataset and verification ownership

PRM00-T04 source freeze, 2026-10-13. Current subscription paths are source-local-done with payments disabled in OpenAPI v1; future cloud/professional shapes are in premium-planned.json and are explicitly not implemented. No client account ID, environment or premium flag grants authority.

Interactive status POST receives only current family/access proof, resolves account via existing account application port, returns capabilities/reason/verified expiry with no purchase tokens or owner identifiers. Verify/restore POST add UUID operation ID and bounded purchase token; require the existing signed request key bound to that same proven account. Signature covers exact body; retries need a fresh nonce but keep operation ID. Store transaction rechecks active owner/session/key binding so logout/unlink/deletion during provider HTTP cannot commit. Verify and restore share the same ownership/idempotency protocol; restore cannot transfer a purchase, credentials, contributor reputation or application records.

subscription owns purchase digests/encrypted tokens, owner bindings, verification generation leases, command receipts, lifecycle revision/retired chains, acknowledgement intents and notification receipts. account remains authoritative for session/account/key-binding status through explicit application ports and reviewed guarded SQL ownership joins. Platform jobs atomically stores durable digest/operation-only requests in the subscription transaction; no plaintext tokens in jobs/logs/responses. Network calls are outside transactions. Provider current state refresh, not notification type/time, determines rights.

cloudsync owns private vehicles/favorites/portable preferences/devices/revisions/snapshots. professional owns refuel/expense/odometer segments/derived reports, accesses private vehicle identity through a port. alerts owns advanced rules/inbox/delivery and reads source-specific current data through ports. Each dataset registers export/erasure/snapshot/deletion-epoch behavior before consumers. New schema IDs begin at 000075, above known dev 000074; main-based source does not import dev/mobile changes.

Free retained-data read/export/delete are separate from new paid service operations; current free account privacy/recovery endpoints remain available. Missing future cloud data returns an honest unimplemented/unavailable state; a status route does not pretend export/report/sync exists.

Verification selectors: existing backend/internal/platform/apicontract for v1/planned/golden contracts; upcoming internal/modules/subscription/{domain,application,adapters,adapters/play,adapters/googlepush,adapters/http,adapters/jobs}; real disposable PostGIS integration for adapters and actual API/worker composition. Each package is created only by its task. Use go test -race -count=1, affected go vet/staticcheck, sqlc vet/diff and OpenAPI lint; record actual commands/results in first-ten evidence. No missing package/zero-test run is passing evidence.

No new runtime dependency is necessary for this batch: net/http, crypto/aes/cipher/rand/hmac/sha256/rsa and encoding/json implement transport and established standard primitives behind ports. Reuse existing pgx/sqlc/chi/job composition. Future OAuth credentials/JWKS lifecycle and real billing/push deployment belong to the user-deferred payment module; no dev-grant flag or permissive provider is wired.

PRM01-T06 source implementation: POST /v1/premium/export pages only owned subscription metadata (product/base-plan/state/expiry/verification/retirement/acknowledgement). Default 20, maximum 100 rows, 15-minute authenticated owner-bound cursor. It operates without a provider, token encryption key or paid capability, including expired subscriptions. No raw token/cipher/digest/session/key is an export item. Future cloud/professional records need their owning export/erasure implementation; this route does not claim those datasets. Status includes the fixed official Play subscription-management destination. Every private success/error uses no-store; subscription success has no ETag. Existing free account deletion remains authoritative and synchronously destroys subscription provider-token bytes.