Treat payment as an external state machine.
A customer leaving checkout does not by itself prove payment. The implementation defines provider redirects or hosted flows, authenticated callbacks, retry behaviour, expiry and the order status allowed for each payment outcome.
- Verify provider callback and signature behaviour
- Design pending, failed, expired and successful outcomes
- Keep retry and duplicate handling recoverable