>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3614065. --> Reported by: [mably](https://www.drupal.org/user/3375160) Related to !16 >>> <p>Audit of everything merged since 1.0.0-alpha1: <span class="drupalorg-gitlab-issue-link drupalorg-gitlab-link-wrapper"><a href="https://git.drupalcode.org/project/kessai/-/work_items/3610530" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/kessai/-/work_items/3610530</a></span>, <span class="drupalorg-gitlab-issue-link drupalorg-gitlab-link-wrapper"><a href="https://git.drupalcode.org/project/kessai/-/work_items/3610757" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/kessai/-/work_items/3610757</a></span>, <span class="drupalorg-gitlab-issue-link drupalorg-gitlab-link-wrapper"><a href="https://git.drupalcode.org/project/kessai/-/work_items/3611852" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/kessai/-/work_items/3611852</a></span>, <span class="drupalorg-gitlab-issue-link drupalorg-gitlab-link-wrapper"><a href="https://git.drupalcode.org/project/kessai/-/work_items/3611872" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/kessai/-/work_items/3611872</a></span>. Those four added the payment expiry deadline with its cron reaper, the payer handoff route, and the storage-schema extension seam, and left a set of gaps behind. This closes them.</p> <h3>Fixes</h3> <ul> <li><strong>Two test classes would fatal on Drupal 12.</strong> <code>PaymentExpiryTest</code> and <code>PaymentHandoffControllerTest</code> were missing <code>#[RunTestsInSeparateProcesses]</code>, deprecated in 11.3 and an exception in 12.0. Every other test class in the module already had it, and the next-major CI lane does not run by default, so nothing caught it.</li> <li><strong>A cancelled or declined payment lost its provider reference.</strong> <code>WorldlinePaymentFinalizer</code> only persisted the reference after the not-accepted branches had already returned, and those branches reload the payment fresh, so the reference was discarded. Both a payer cancellation and a decline now keep their link to the provider payment, which is what the back office needs to find the provider-side record of what happened.</li> <li><strong>Expiry left no audit trail entry.</strong> <code>PaymentAuditTrailBridge</code> subscribed to five events but not <code>EXPIRED</code>, so a payment that resolved by lapsing left a gap in the tamper-evident chain while every other terminal state was recorded. Its docblock also still described the pre-alpha1 event vocabulary.</li> <li><strong>The handoff route did not validate its onward URL.</strong> The payer-supplied <code>return</code> argument went straight into a redirect. Core refuses a non-local redirect from a plain RedirectResponse and answers 400, so a stale or external value stranded the payer on an error page in the middle of paying. It now falls back to the front page, the same treatment the gateway return route already gave its stashed URL.</li> <li><strong>The handoff link was unbounded.</strong> The per-payment token is a bearer capability derived from the payment id, so a stale link could keep opening fresh provider sessions for as long as the payment stayed pending. The handoff is now refused once the payment is past its deadline.</li> </ul> <h3>Documentation and translations</h3> <p>None of the four merged issues touched <code>docs/</code> or <code>translations/</code>, and the documentation site publishes from 1.x, so the published pages described neither new event, the new state, the deadline, the reaper, nor the handoff route.</p> <ul> <li><code>docs/events.md</code>: both new events, with the handoff and the deadline explained.</li> <li><code>docs/index.md</code>: <code>expired</code> in the lifecycle diagram, and a quick start that hands the payer off instead of calling <code>initiate()</code> directly.</li> <li><code>docs/architecture.md</code>: the <code>expires</code> field, an Expiry section, and the storage-schema extension seam from <span class="drupalorg-gitlab-issue-link drupalorg-gitlab-link-wrapper"><a href="https://git.drupalcode.org/project/kessai/-/work_items/3610757" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/kessai/-/work_items/3610757</a></span>, which shipped undocumented.</li> <li><code>docs/gateways.md</code>: how a redirect gateway hands the payer off.</li> <li><code>README.md</code>: the new state, field, manager methods and events.</li> <li><code>docs/metrics.md</code>: new generated page, with <code>scripts/generate-metrics.php</code> to regenerate it.</li> <li><code>translations/fr.po</code>: the three missing msgids.</li> </ul> <h3>alpha2 is reinstall only</h3> <p>The payment entity gained a base field and an index after alpha1, and no update path is provided: while the module is in alpha, reinstalling is the supported way to pick up a schema change. That is deliberate, so no partial upgrade path implies a stability guarantee the module is not ready to make.</p> <h3>Verification</h3> <p>The touched test classes pass with no deprecations. phpcs (Drupal and DrupalPractice at warning severity 1), phpstan level 2 and cspell are clean. The full suite runs in CI on the merge request.</p> <h3>Follow-up</h3> <p>The expiry policy itself, and the handoff route session handling, both need a design decision and are split into a separate issue.</p>