Edge cases and exception matrix

Status: Operational design input. Final remedies depend on partner API capabilities, scheme rules and merchant agreements.

Scenario	Required system behaviour	Owner / evidence
Same bill submitted twice	Return idempotent result or explicit conflict; never duplicate collection	Billing; request key and bill version
Bill amended after scheduling	Version change and revalidation; cancel/replan only if no irreversible attempt	Billing; audit and notifications
Bill cancelled during in-flight attempt	Mark cancellation pending; query provider; do not promise reversal	Operations; provider reference
Consumer revokes mandate before run	Block new attempts and notify merchant	Consent; revocation event
Consumer revokes during pending payment	Prevent new attempts, reconcile submitted attempt	Payments; event timeline
Card expires before collection	Prompt update; do not select ineligible method	Consumer notifications
Primary hard decline	No same-method retry; backup only if permitted	Orchestration; decline class
Primary soft decline	Apply bounded, documented retry policy	Orchestration; policy version
Provider request timeout	UNKNOWN and lookup; no blind re-charge	Payments; correlation ID
Webhook duplicate or out of order	Deduplicate and preserve monotonic state	Provider inbox; event IDs
Provider outage before cutoff	Backoff, alert and notify when deadline threatened	On-call; queue metrics
Settlement less than expected	Hold payout and investigate discrepancy	Finance; provider statement
Chargeback after payout	Open risk/finance case and compensating journals	Finance/risk; original collection
Payout rejected/returned	Reconcile funds, hold/reallocate and notify merchant	Finance; payout return evidence
Merchant payout destination changed	Reverify and step-up/dual approval; apply hold if needed	Merchant risk; approvals
Multiple merchants share consumer	Preserve merchant-specific mandates and preferences	Identity/consent; access tests
Incorrect consumer linkage	Freeze affected mandate, investigate and remediate	Support/security; case
Merchant suspended mid-cycle	Stop new initiation, resolve in-flight items, retain payable records	Risk/operations
Reconciliation discrepancy	Create aged case, do not force ledger balance	Finance; exception record
Fee rate changes mid-month	Apply effective-dated pricing to each qualifying collection	Commercial; agreement version
DST/business day cutoff	Use explicit timezone and provider holiday calendar	Scheduling; deterministic tests
Notification bounce	Retain delivery failure; do not infer absence of consent	Communications; delivery log
Data deletion request	Apply privacy rights subject to financial retention and legal holds	Privacy; decision evidence

Exception lifecycle

DETECTED → TRIAGED → ASSIGNED → INVESTIGATING → ACTION_PENDING → RESOLVED → CLOSED; separate ESCALATED and REOPENED transitions. Every case has severity, owner, due time, source evidence, customer impact, financial exposure, decision and closure verification.

Controls

No automatic ledger adjustment to make reconciliation pass. No manual retry of UNKNOWN outcomes without provider confirmation. No payout release without eligible funds. No silent changes to mandates, bill amounts or merchant payout destinations.