Repeated external reviews of 1.x for beta readiness found the defects below. Each was checked against the code, and the ones that move money wrongly were reproduced by a kernel test against the code before the fix. ### Money moves once - **A lost answer, asked again, moved the money a second time.** - A claim, refund or release asked again after the provider forgot its idempotency key (Worldline keeps one for at least 24 hours) was carried out twice when partial. - A hold or charge made with the payer gone, re-sent after its answer was lost, charged the card twice. - Over the wire, a consumer whose answer timed out had no way to say "this is the same request". - **A webhook or a return settled the wrong thing.** - A rejected first attempt failed a checkout the payer could still pay. - Two late acceptances arriving together overwrote each other. - A released hold reported again read as new money. - **Deleting a payment whose money was still moving left no record of it**, and the guards held only on one of the doors a payment is deleted through. - **Late money**, taken by a provider after a payment ended, could be given back twice, attached to an unrelated movement, or not found again. - **A lapsed hold could never leave "authorized".** Worldline's "not allowed on this transaction" answer was always treated as still settling. ### What a caller can rely on - `capture()`, `refund()` and `release()` take an optional request key. Asked again under the same key, the movement it made answers, or its refusal does, and no money moves twice. - A charge made with the payer gone records the payment whose stored payment method it used (`source_payment`). Asking again therefore sends the same request. - A claim, refund or release whose answer was lost for 23 hours or more is not sent again. It is looked up among the transaction's operations: completed if it happened, failed otherwise, with an error naming the transaction to check. - A consumer waits longer than the host takes for one movement of money. ### Input checked before storage - **MySQL ignores trailing spaces on kessai's exact-match columns**, so `A12 ` was `A12`: a create was answered with another order's payment, and a charge took the card another payer stored. A value kessai matches on — subject, metadata, consumer, token, client id — may not end in whitespace. - **A caller's mistake failed in the database** instead of being refused: text that is not UTF-8, a kind or account uuid its column cannot hold, a token longer than its column, a validity before 1970. Each is now an `\InvalidArgumentException`, answered 400 over the wire. ### Each site's payments kept apart - **A host that also has its own content loaded its own entity as another site's subject**: another site's payment for its order 42 loaded the host's order 42, and a subscriber confirmed or cancelled it. On the host, `getSubject()` answers nothing for a payment taken for another site. - **A site running its own engine beside a client could send its own payment to the host**, which settled the host's payment of the same number. The client settles only payments it read from a host. - A consumer's return address must be a whole address, and the payments listing shows which consumer a payment was taken for. - **A site copied to another environment kept trusting the host it was copied from.** Pointed elsewhere from `settings.php`, its remote still read the old host's accounts and sent the old access token, to the new host or as another consumer on the same host. What a remote learns is now kept with the address and the client id it was learned from. - **The client took a host's answer about another payment for the one it asked about**, and routed the next call by that payment's account. It is refused. - **A consumer could report its own card payment paid**, and the host recorded it captured with nothing taken at the provider. Only a payment settled by hand takes a consumer's word. ### Sites, environments and domains - A consumer site installed under a path, such as `https://example.com/shop`, was never told a payment moved: notices went to the root of its host. The site field now takes the path. - A site serving several domains gives each domain a remote of its own. The status report warns about a remote that reaches no account where it calls, and the remote listing shows remotes as they run. ### API settled for beta - The consumer is taken out of the contract: an engine acts for this site, or for one consumer through `forConsumer()`. - `recordPaymentReceived()` is split from `capture()`. - The agreement to charge later is named after the payment method (`store_payment_method`, `forgetStoredPaymentMethods()`). It is refused on a zero amount and on an account that cannot charge later. - Gateway-neutral names throughout, a reserved `kessai_` namespace for kinds and metadata names, and the wire names in one shape. The full list is in the merge request's commits, one per finding. New base fields and a changed field type: reinstall, as for every alpha. --- AI-Generated: drafted with Claude Code.