the price the client is not allowed to state

Two facts decide what a customer is charged: whether their address falls inside a delivery zone, and whether a discount they claimed still applies. Both arrive from a browser, and both are editable in a browser. The version of this feature that ships by default trusts what it receives — the zone the client says it resolved, the discount the client says it earned — and works perfectly until someone decides not to be honest.

What landed instead re-derives both at the moment of charging. The coverage lookup is re-run on the server from coordinates, and a point outside every zone is a hard refusal rather than an approximation, because a silent fallback to some default fee charges real people the wrong amount. The discount is re-checked against the current promotion set and the customer's actual redemption history. A claim that lapsed since the basket was priced is refused with an error, and explicitly not repriced — the design note is blunt that quietly changing the total is worse than failing.

The order record then keeps the facts that were used: which zone, which fee, which estimate, which promotion, what discount. A price that cannot be reconstructed later is a price nobody can defend in a dispute.

Clients that send no coordinates keep a static-configuration fallback, so the change shipped without a coordinated browser release. That is a deliberate concession, and it makes the old path a thing to retire rather than a thing to maintain.

What it proves: the team treats the browser as a display surface rather than a source of truth, and makes the honest refusal the default even when the dishonest answer would look smoother.