One engineer.
AI agents.
The whole system.

// Runs inside the payment callback. Never throws: a failed refund is
// logged and retried, so the gateway always gets its ACK.

const SURPLUS_REFUNDABLE = new Set([
  'cancelled', 'pending_ship', 'shipped', 'pending_receive',
  'completed', 'refunded', 'refunding', 'offline_pending_review'
]);

async function refundOrphanPayment({ Pg, appendLog }, orderId, paymentId) {
  const payment = await loadPayment(Pg, paymentId);
  if (payment?.order_id !== orderId) return skip();
  if (payment.status !== 'paid') return skip();

  const order = await loadOrder(Pg, orderId);
  // a pending order means this is the first, legitimate payment
  if (!SURPLUS_REFUNDABLE.has(order.status)) return skip();

  return Pg.withTx(async (client) => {
    const { rows: [row] } = await client.query(
      `SELECT amount, status FROM order_payments
        WHERE id = $1 FOR UPDATE`, [payment.id]);
    const used = await sumRefundedOrPending(client, payment.id);
    const remaining = row.amount - used;
    if (remaining <= 0.001) return skip(); // idempotent on replay

    await markRefunded(client, payment.id);
    await writeLedger(client, order, remaining, 'orphan_payment');
    return refundViaOriginalChannel(payment, remaining); // wechat | balance
  }).catch((err) => appendLog('orphan-refund-failed', { orderId, err }));
}