Payment response misclassification
A gateway returns HTTP 200 for a declined payment. The first implementation treats transport success as payment success and advances the transaction state.
- Acceptance criterion
- Only a confirmed provider approval may transition a payment to completed.
- First-pass gap
- No mapping between provider result codes and the domain state machine.