# Step 21 integration checklist (test/sandbox first)

- [ ] Run migration 013 only after migrations 001–012 in the NEW ResellBD database.
- [ ] Confirm `orders.payment_method` retains COD/manual methods and adds gateway placeholders.
- [ ] Verify `payment_gateway_transactions` rejects duplicate idempotency keys and merchant references.
- [ ] Verify provider event tables reject duplicate `(provider_code,event_id)` events.
- [ ] Confirm no browser redirect or unsigned webhook can set an order to paid.
- [ ] Confirm `ManualGatewayAdapter` remains pending and cannot mark payment paid.
- [ ] Confirm `ManualCourierAdapter` never fabricates booking/tracking status.
- [ ] For a real provider, use its official current documentation and sandbox credentials; implement exact signature, token, amount/currency, merchant/order reference and server-to-server verification rules.
- [ ] Test malformed JSON, missing event ID, invalid signature, replayed event, amount mismatch, unknown order, provider timeout and duplicate callback.
- [ ] Verify logs do not include secrets, full payment credentials or sensitive customer data.
- [ ] Test cURL/network allow-listing and webhook endpoints on staging before production.

This is an adapter foundation, not a live Nagad/card/Pathao/Steadfast integration or a security certification. No provider-specific API URLs, signatures or payloads are guessed.