Payment & checkout testing checklist — the cases where money breaks
Checkout is where money and trust meet, yet it's usually tested with card 4242 and the happy path. A first-person take: money as integer minor units, not floats; double charges and idempotency; bank declines as normal, not a 500; 3-D Secure and the abandoned challenge; the webhook as source of truth, not the redirect; recomputing totals and promo codes on the server; PCI and tokenization; network drops at every step. Plus a flat 16-point checklist.