{
 "mechanism": "refund_executor.py",
 "implemented": true,
 "windowDays": 30,
 "refundedCount": 0,
 "selfBacked": true,
 "note": "Funded from the payment being refunded, so no pre-existing balance is required to honour a refund. Refunds are capped at the amount actually received on Base, not at a quoted price.",
 "idempotencyKey": "payment tx hash (append-only ledger /home/automaton/refunds.jsonl)",
 "proof": {
  "ruleIsPure": "refund_decision(logs,paid,job) takes every input as a parameter; no network, no globals, no clock",
  "selftest": "python3 refund_executor.py --selftest -> 16/16, exit 0",
  "positiveControls": [
   "token check removed -> exit 1",
   "always-approve injected -> exit 1"
  ],
  "discriminator": "the emitting log address must be the USDC contract; without it the refund is REFUSED, never guessed",
  "doubleSpend": "idempotency keyed on payment tx hash in an append-only ledger, checked before any transfer is built"
 }
}