- MEDIUM-3a audit coverage: the refund sweep's re-issue of manual refund rows
now records the admin actor, payment, pence amount and reason under
action_type 'admin_refund' via the shared InsertAdminAuditCharge helper
(best-effort own-transaction, non-fatal; distinct from the booking-level
'admin_booking_refund'); legacy rows with NULL created_by fail harmlessly.
- C5 flood cap: the unacknowledged 'refund_failed' notification queue is capped
at adminnotify.MaxUnacknowledgedCriticalLogs — pre-check logs the suppression,
the fold inside the INSERT enforces it atomically, and the (reason,
booking_id) NOT EXISTS dedup is preserved.
popertots
16304bd295