spec update to address #6616

1 files changed, 7 insertions, 6 deletions

diff --git a/design-documents/007-payment.rst b/design-documents/007-payment.rst
index 8f7050d..0095d1d 100644
--- a/design-documents/007-payment.rst
+++ b/design-documents/007-payment.rst
@@ -45,16 +45,17 @@ When *resource-URL* is requested, the storefront runs the following steps:
 
 4. If *session-ID* or *order-ID* is null, assign a fresh session ID and
    create a new order for *resource name* by doing a ``POST /private/orders``
-   to the merchant backend.  Set both in the cookie to be sent with the response.
+   to the merchant backend. Set both in the cookie to be sent with the response.
 5. Check the status of the payment for *order-ID* under *session-ID* by doing a ``GET /private/orders/{order-ID}?session_id={session-ID}``.
    This results in the *order-status*, *refund-amount* and the *client-order-status-URL*.
-6. If the *order-status* is paid and *refund-amount* is non-zero,
+6. If the *order-status* is claimed, set *order-ID* to null and go back to step 4.
+7. If the *order-status* is paid and *refund-amount* is non-zero,
    return to the client a page with an explanation that the payment has been refunded. **Terminate.**
-7. If the client has not (fully) obtained the granted refunds yet, show a link to the public order page
+8. If the client has not (fully) obtained the granted refunds yet, show a link to the public order page
    of the backend to allow the client to obtain the refund.  **Terminate.**
-8. If the *order-status* is paid, return to the client the resource associated with *resource name*.  **Terminate.**
-9. Otherwise, either the *order-status* is unpaid or the customer tried to access a paid resource after having deleted their cookies.  Redirect the client to *client-order-status-URL*. **Terminate.**
-10.  If the wallet detects that the resource was paid before, it will resend the same payment again, and will get the item; if not, the wallet will create a new payment and send to the merchant.
+9. If the *order-status* is paid, return to the client the resource associated with *resource name*.  **Terminate.**
+10. Otherwise, either the *order-status* is unpaid or the customer tried to access a paid resource after having deleted their cookies.  Redirect the client to *client-order-status-URL*. **Terminate.**
+11.  If the wallet detects that the resource was paid before, it will resend the same payment again, and will get the item; if not, the wallet will create a new payment and send to the merchant.
 
 .. note::