Model Boundaries Under Pressure

A shared package can become a shared domain model and leak policy.

Checkout may keep a local read model built from explicit contracts.

Any duplicated product fields prove the split is wrong.

A shared package is acceptable only for stable contract types or neutral primitives.

Checkout must call every upstream service for every render.