The three golden rules of honest financial terminals
Terminal firmware breaks in patterns. Three rules would eliminate about half of the incidents I've been paged for.
Compressed from a decade of terminal reviews and post-incident writeups.
Based on notes from Ingenico incident reviews 2021–2024; written 2026-07.
Rule 1: the terminal is not the ledger
The terminal is a UI + a message adapter + a small state machine. It is not the source of financial truth. Whenever a terminal writes to the display "APPROVED", it is asserting what it observed, not what the ledger says. If those two ever disagree, the ledger wins — always.
Rule 2: idempotency lives in the request, not the retry
If your terminal firmware generates a fresh transaction id every time the operator presses "retry", you have already lost. The logical-operation id must be sticky across retries; only the attempt id changes.
Rule 3: ACK loss is not decline
If the terminal sees the approval and the ACK back to middleware is lost, the terminal is still correct. The delivery layer has failed. The customer's transaction has not.