[sx4im]

What this changes

SHOPIFY_CREATE_REFUND moves money but sailed through the safety policy: "refund" was not in the payments keyword list. Added it, so refunds hand off to the person like any other money movement. Also locked in the other half of #890 with a regression test: writing only an order note (SHOPIFY_UPDATE_ORDER with id and note) does not hand off.

Where it runs

No new state, no listeners, no schedules. The matcher is a pure function of the candidate, so every replica decides the same way.

• New state that outlives a request? None.
• What happens on the second replica? Identical outcome, no shared state involved.
• Anything serialised? Nothing new.
• Anything fanned out to a browser? No.
• New listener, port, or schedule? No.

Boundary and audit

• Every acting call still goes through the gateway: resolve, decide, audit, then act.
• New refusals and new failures each write a row. Refund hand-offs write approval.evaluated like every other safety hand-off.
• Nothing new is trusted from the client that the server can resolve itself.

Changelog

• A line in CHANGELOG.md under Unreleased.

Proof

bun test server/tests/approvals-policy.test.ts: 33 pass, 0 fail. The new test "refunds move money; writing an order note does not" fails before the fix (refund came back undefined) and passes after. tsc --noEmit clean on server. The DB-backed integration suite needs TEST_DATABASE_URL, not available here; the pure-policy suite covers this change.

Fixes #890