14 — QA Checklist (Payments)

• Functional
• Concurrency / integrity
• Visual
• Accessibility
• Performance
• Offline / network
• Security
• Localization
• Animation

Module-specific checks layered on 00-shared/10_QA_Baseline.md.

Functional

• Record cash payment → receipt generated, invoice paidAmount updates to PAID/PARTIAL.
• Payment without invoiceId → succeeds, no invoice link, no crash.
• Partial then full refund → partially_refunded → refunded; refundedAmount sums.
• Refund on non-completed → 409 message, no state change.
• Refund exceeding amount → 409, blocked.
• Reconcile success/failed/unknown → completed/failed/pending mapping.
• Reconcile nonexistent ref → 404.
• Lists paginate with {data,total}; last page shows "end".
• GET by invoice returns only that invoice's payments (tenant-scoped).
• Receipt view renders full data incl. fee/currency/paymentMethod/issuedAt.
• Payment list filters (status/search) work client-side across pages.
• Receptions: offline publishes payment → UI blocked (never optimistic).

Concurrency / integrity

• Double-tap submit produces exactly one payment (flag OQ-3: no idempotency key).
• Two concurrent refunds don't exceed refundedAmount (server 409 check).
• sumByInvoice only counts completed payments.
• Transaction reference + receipt numbers unique (report duplicates = bug).

Visual

• Light/dark token-only colors; status colors meet contrast (non-colorblind safe).
• Money tabular figures; currencies formatted locale.
• Responsive phone/tablet/desktop reflow; FAB hide/show.

Accessibility

• TalkBack/VoiceOver reads full money amounts + status labels.
• Focus order on forms; Enter submits; ESC cancels sheets.
• Dynamic type 2×: cards/lists reflow, no clipping.
• Errors announced via live region; focus to first invalid field.

Performance

• List first frame ≤ 300 ms cached; ≤ 2 s network.
• Pagination doesn't drop frames; money rendering stable.
• No duplicate request spikes on pull-to-refresh.

Offline / network

• Offline banner on all screens; cached lists render; writes blocked with clear copy.
• Network loss mid-submit shows failure + retry; no duplicate server money movement after retry (verify server dedup — OQ).

Security

• Cross-tenant payment id access → 404 (repository tenant-scope).
• Refund/reconcile hidden without permission (client) and enforced server (planned).
• No payer PII in analytics event payloads.
• Gateway refs not logged to crash logs.

Localization

• En + candidate locales numbers/dates; RTL announcement-ready.
• Long translated strings don't break receipt card.

Animation

• Transitions use tokens; reduced-motion respected; no dropped frames on success transition.