The vendor-URL pattern: the POST returns a Roster-hosted URL wrapping the whole donor flow. The reliable outcome signal is the webhook / event feed — never the redirect.