Met with ER to go over state of the ecommerce testing for their site. Settled on the best kind of solution (i.e. Beanstream's inventory and shopping cart system addressed by pages on the Malahat site, rather than everything on the beanstream server (i.e. a complete custom-built store) or everything on the malahat server (again entails custom-built store and then code to transact the actual financial details).
At the meeting, still having problems with the hash-value validation with the shopping cart page. Eventually solved that by emailing RE who put me onto someone in the bookstore (they'd written their own custom store) who put me onto a BeanStream guy. The Beanstream guy was good and within half an hour problem was solved. There are two checkboxes in the admin interface "require hash value" and "include hash value". The first must be not checked and the second checked for use with the shopping cart. My guess is that if the site is being addressed directly from pages on the client's server (i.e. with code that injects the correct hashvalue in the correct place in the submission), then both those have to be checked - but I'm not sure about that.