Order-to-cash medium gaps (audit-M-o2c / audit-M-sales)

[OneTwo3D]

Wave 4 of the workflow-audit remediation (epic onetwo3d-ims-r3xh). Closes the two duplicate order-to-cash medium clusters (47fa + chc2).

Fixes

1. Refund tolerance — the cumulative-refunded check used a 0.1% relative slack (pounds of headroom on a large order; partial refunds could creep over). New pure refundWouldExceedOrderTotal() applies a fixed rounding epsilon (0.011) to the cumulative total.
2. Payment-deletion status mismatch — deletePayment now detects when an order became not-fully-paid while in an advanced status (SHIPPED/COMPLETED/DELIVERED/PARTIALLY_REFUNDED) and emits a payment_status_mismatch WARNING; the SO detail shows an amber "<status> but not paid" chip.
3. Archived guard — applySalesOrderStatusTransition rejects status edits on archived orders (manual + sessionless-cron callers); the WooCommerce force-sync bypass token keeps its escape-hatch semantics.
4. Invoice idempotency key — VERIFIED already payload-based (accountingPayloadKey(..., payload)); no change needed.
5. Double-shipment — VERIFIED confirmSalesOrderShipments already nets committed (non-PENDING) shipment lines out of the allocation before recreating; no change needed.
6. Docs — documented COMPLETED vs DELIVERED semantics + the archived / payment-mismatch behaviour in docs/workflows.md.

Shared pure o2c-guards.ts reused by both call sites.

Tests

5 guard cases (refund within/at/over total incl. the relative-vs-fixed contrast; mismatch true/false); 105/105 sales suite; type-check + lint clean.

Closes onetwo3d-ims-47fa, onetwo3d-ims-chc2.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[OneTwo3D]

Codex adversarial review — findings + fixes (commit c0c051f)

Codex was at its usage cap; the adversarial pass ran by hand with equal rigour.

Verified sound: refund epsilon currency basis (all three operands in base currency); the WC force-sync bypass still transitions archived orders; refund-payment (credit-note) deletions don't flag a mismatch; verified-only claims confirmed — the invoice queue idempotency key genuinely hashes the payload, and confirmSalesOrderShipments genuinely nets committed non-PENDING lines so a deleted PENDING shipment can't double-ship.

Fixed:

• HIGH — archived guard blocked the delivery cron. An archived-but-SHIPPED order could never auto-reach DELIVERED. The guard now lets skipPermissionCheck (the cron) through alongside the WC force-sync token; only genuinely-manual edits are rejected.
• HIGH — false mismatch warning. payment_status_mismatch fired even when the order was never fully paid (shipped on credit, a held partial payment deleted). Now requires a genuine paid→unpaid transition (so.paidAt was set before the delete).
• MEDIUM — false-positive chip. The read-time !so.paidAt amber chip false-positived on credit-term / WC-imported-partial-refund orders and contradicted the existing "Part. Paid" indicator. Dropped it — a read-time chip can't distinguish "never paid" from "was paid then unpaid" without a persisted marker, so the accurate signal is the (now transition-gated) WARNING activity log plus the existing Paid/Part. Paid chips. Docs updated.
• LOW: added a single-shot full-refund test.

Validation

7/7 guard tests; type-check + lint clean.