# Payment Module — Manual Review Checklist

High-risk module: payment changes require human confirmation for every
blocker/major fix.

- [ ] Callback idempotency: a duplicated webhook/callback does not double-charge
- [ ] Amounts stored as fixed-point (integers/cents), never floats
- [ ] Currency codes and precision handled correctly
- [ ] Provider signature / HMAC verification on callbacks
- [ ] Refund logic: correct reversal, no double-refund
- [ ] Failure path: payment timeout, declined, retry semantics
- [ ] Transaction boundary spans charge + order-state update
- [ ] Sensitive data (PAN, tokens) never logged or masked on output
- [ ] Ledger/journal entries are append-only and auditable