Routing And Redirect Trust Gaps

Client-controlled redirects and duplicated route prefixes cause requests to match the wrong endpoint and return unverified payment state, while premature access to route scope/metadata and missing CORS origins break integration assumptions.