Reviews, returns, and support

Verified reviews

Only the buyer who owns a delivered or completed order can create its review, and the database permits one review per order. Public aggregates include published reviews only and use deterministic ordering. Hidden reviews do not affect public summaries.

Disputes and return cases

A buyer-authenticated order can open one of the supported return/dispute types when its state is eligible. Legal transitions, evidence requirements, buyer/order/merchant scope, order changes, and audit snapshots commit together. Operations records a resolution; provider money movement remains a separate gated workflow.

Private evidence uploads

Private uploads validate purpose, owner, order, content type, extension, and size. Objects are not public assets. A failed metadata transaction cleans up the object; deletion removes metadata with best-effort object cleanup. Protected readback rechecks ownership or administrative authority.

Conversation support

Support cases preserve a transcript/resume checkpoint and declare whether they affect no automation, one typed subject, or the whole conversation. The operations queue exposes that scope with severity, SLA, assignee, and bounded transcript. Cross-admin ownership is rejected. Resolution requires notes; only mandatory conversation holds need an explicit automation release.

Privacy-request intake is a separate audited queue. Completion is fail-closed: the default-on guard records an append-only versioned category assessment and keeps the request non-terminal when any deletion or anonymisation postcondition is unproved. Full automated fulfilment is not implemented.

Evidence and tests

• src/reviews.ts
• src/disputes.ts
• src/uploads.ts
• src/support.ts
• src/privacy.ts
• test/phase5.e2e.test.ts
• test/support.test.ts
• test/security.test.ts