>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3614252. --> Reported by: [mably](https://www.drupal.org/user/3375160) Related to !27 >>> <p><code>PaymentManager::forgetCard()</code> is how a consumer says "forget this card". For a payment whose gateway does not implement <code>TokenGatewayInterface</code>, it currently keeps the alias and logs a warning, so the card is never forgotten. The one call that exists to erase a stored card silently declines to.</p> <p>Reproducible in a few lines: create a payment on the bundled <code>manual</code> gateway, set a token on it, call <code>forgetCard()</code>, and the token is still there afterwards, with "Cannot delete the stored card for payment N: gateway manual does not support tokens. Keeping the local token." in the log.</p> <h3>How it got here</h3> <p><span class="drupalorg-gitlab-issue-link drupalorg-gitlab-link-wrapper"><a href="https://git.drupalcode.org/project/kessai/-/work_items/3614202" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/kessai/-/work_items/3614202</a></span> gave gateways declared capabilities, and <code>ManualGateway</code> deliberately does not claim <code>TokenGatewayInterface</code>, which is correct: there is no card to charge again. Nothing was wrong with that change. What it exposed is that the retain-on-no-capability branch in <code>forgetCard()</code> predates it and was written for a different situation.</p> <p>The comment there explains the reasoning: clearing the local token "would abandon an alias nobody can find again". That holds for a token-capable gateway whose delete <em>failed</em>, which is the branch right below it, and that branch should keep retaining, because a later retry can still succeed. It does not hold for a gateway that has no tokens at all: there is no provider-side alias to orphan, so the stored value is orphaned data already, and retaining it buys nothing.</p> <p>It is the same shape as the reconciliation fix in <span class="drupalorg-gitlab-issue-link drupalorg-gitlab-link-wrapper"><a href="https://git.drupalcode.org/project/kessai/-/work_items/3614213" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/kessai/-/work_items/3614213</a></span>: do not hold something back waiting for an answer that is never coming. A gateway with no token support will never gain the ability to delete this alias, so the retention is permanent.</p> <h3>Why it matters</h3> <p>This is a data retention defect rather than a money one. A caller that asked for a card to be forgotten is told nothing, the payment keeps the alias indefinitely, and any deletion policy built on <code>forgetCard()</code> quietly does not apply. The consumer that surfaced it drives exactly that: an orchestra run flags a card for deletion when the run ends, and the flag now has no effect.</p> <h3>Fix</h3> <p>Clear the local token in that branch too, and keep a warning so an operator learns the alias could not be deleted at any provider and may need removing by hand if it was created by a different gateway. The failed-delete branch below is unaffected and keeps retaining.</p> <p>Nothing covered this: the manager tests only exercise <code>forgetCard()</code> against token-capable gateways, which is why the alpha2 audit did not catch it either. It surfaced from orchestra's test suite running against the new kessai.</p>