checkout_exception for external processor payments?

There are a few lingering problems with external payment processing.
- Security. The receipt link back to the store could be spoofed so the cart thinks it was paid but wasn't.
- Continuity. If the customer doesn't click on the "Click to return to store" link, the order can be lost or left in a non-final state if you pre-save the order as pending or unconfirmed (similar to how the improved paypal contrib and current Authorize.net module work).
- Potential for multiple orders. If you pre-save the order in a pending/unconfirmed state, and the user clicks back to change something, now the order id is different.
- Asynchronous states. If the Payment went through ok, and the customer clicked to go back, but somehow the session was corrupted, you have only 2 options, Success and Fail. The payment was a success, but the cart processing was not.

What happens when the customer does it all right but something bad happens and something like a ref number doesn't match up? Where do you send the customer? You can't do the "Checkout_Failed" route because they successfully paid for "something" and if they see "failed" you will just scare them. You also can't do the "Checkout_Success" route because then it looks like everything went smooth to the customer, but there is no order on your side.

Perhaps we need something to handle the "gray" area. Something that flags to the admin that an order needs attention, but calmly notifies the customer without scaring them. They could see something like "Your order has been completed, however, it will need to be reviewed before finalizing as there was some unexpected messaging from the credit card processor. We will contact you if there is a problem."

And the Store owner would see the order flagged with a special state like "Needs Manual Review".

Maybe the customer doesn't need to see a special "checkout_grayarea.php" page. They can just see success, but the order state can still be marked as "Needs Manual Review" and can handle it from there.