PRODUCTION FOUNDATION · ORDER EXCEPTIONS

Problems stop the money clock instead of rewriting the sale.

v0.12.19 adds server-owned cancellations, refunds, returns, claims/disputes, payout holds, and exactly-once inventory compensation. Refund decisions and provider execution remain separate evidence.

TEST NOWApply migration 0018, run the disposable server self-test, then use a QA Maker session to create a visible cancellation or return fixture in Returns & Resolution.

PRODUCTION LATERReal refund API calls/webhooks, chargeback provider deadlines, carrier return labels, tax/refund allocation, admin/support MFA approvals, fraud scoring, and real payout reversal/negative-balance collection remain gated.

EXPECTED SCHEMAv18order exception ledger

REFUND PROVIDERNot connectedQA simulation only

PAYOUT SAFETYHold-awarerelease blocked while active

SERVER HEALTH + LIFECYCLE

Can a problem change state without corrupting the original order?

The self-test proves payout hold placement, exactly-once cancellation restock, provider-pending refund state, provider confirmation, cross-case refund ceilings, return authorization, and dispute payout blocking.

VISIBLE MAKER TEST

Create a disposable case in the real Resolution UI

Start a QA Maker session first. Create a cancellation fixture, approve it, verify the refund stays pending-provider, then use the QA provider confirmation button. Or create a completed-order return fixture.

Open Returns & Resolution →

PASS CONDITIONS

What this release must prove

Open case creates payout holdPayout release is rejected while any linked hold remains active.Cancellation compensation is idempotentTracked stock is restored exactly once, never twice on retries.Refund approval ≠ money returnedApproved refunds remain pending provider until external confirmation.Refund ceiling spans every caseA second claim/dispute cannot approve the same Maker-order balance again.Return evidence stays separateAuthorize → received/inspection → refund decision is auditable.Dispute blocks payout releaseMaker cannot simply close a processor dispute on their own.

Resolution boundaryPassing v0.12.19 proves the server state machine and safety rails. It does not prove that money moved, a chargeback was answered, a return label was purchased, or a payout was clawed back from a real provider.