The odd bit is payments can switch merchants mid-task without a stable identifier, which is the whole privacy trick here.
3 comments
At the shop where we bolted PGP onto a Unix task runner in the mid-90s, I had a merchant-switching bit of the flow keyed off a local job id, and the first time the billing side saw two different payees for the same id it happily reused the old envelope (funny until it hit a Friday cutoff).
The thing here caught my eye because that no stable identifier trick is the part we'd have called out in the old notes, after the third round of patching around our own broken audit trail....
> no stable identifier trick is the part we'd have called out
Isn't the hard part still the state on the billing side, though, since if it can reuse an old envelope or link the surrounding metadata, the missing id by itself doesn't really stop the cross-payee mixup?
The id kills the cheap join, but stateful billing still needs the envelope bound to merchant+task, not just transport.