Bind one selection to one owned item

The cart UI, server selection and eventual order line must retain the same verified origin.

Mount inside the real form

Each cart context owns exactly one input and its own radio group and Refresh ID. The shared binder uses a context-qualified selection name unless the operator supplies an existing unique fieldId. Missing, ambiguous or already-claimed fields are rejected rather than borrowed from another item.

Persist through the operator

OrderingPlatform::saveSelection rechecks current ownership and eligibility before storing the canonical number while preserving unrelated metadata. Map form tokens back to authoritative item identities; never treat an encoded browser identifier as permission.

Protect the immutable origin

At order creation, persist the source-item relationship independently of the selection receipt. withOrderLine must verify that immutable origin before fulfilment. Receipt resource_id must match originating_item_id even when account, product and number otherwise appear correct. A fresh carrier offer cannot bypass an origin mismatch.

The relationship that must survive checkout

The relationship that must survive checkout
Stage	Persist or verify
Cart mount	One unique field and radio group per actual item context
Selection update	Canonical number saved through current item ownership checks
Checkout	Private server-produced receipt with its original offered_at
Order creation	Immutable originating-item relationship, separate from the receipt
Fulfilment	Receipt resource_id equals independently verified originating_item_id under the order-line guard