configuration that refuses to pretend

The most expensive failure in a payment path is not an outage. It is a system that believes it has been paid. A test gateway left reachable in a live configuration, a placeholder credential that authenticates nothing, a fallback that reads an unconfirmed response as settlement — each of these produces an order that looks complete and a reconciliation that never balances.

The design that landed makes the payment mode a closed set with no default that can drift toward money. Absent means payments are off, which keeps existing deployments working. An unrecognised value is a startup failure rather than a warning. In the live mode the rest of the configuration is checked against known placeholder shapes, and against the endpoint not being a loopback or placeholder host, and the failure output names which setting is wrong while never printing its value — because a startup error is the wrong place to leak a secret.

The mode that would otherwise be most dangerous, the one where a simulated gateway could stand in for settlement, is compiled but never instantiated, and its dispatcher disables itself when unconfigured. It is not reachable by configuration accident.

The remainder is a plan with a way back: enabling live payments is an ordered sequence covering secret provisioning, build-time wiring, validation, monitoring and a defined reversal.

What it proves: the loudest checks sit exactly where a system could begin lying about money, and the price is a boot that is allowed to refuse.