feat(qa): pass I, money flowing backwards

Pass B buys. Nothing unbuys. The reverse paths -- refund, chargeback,
cancellation, failed renewal -- are where builds implement the checkout-success
webhook and stop, so access is granted once and never revoked.

Marked *(only where money moves)*, and the instruction with it is to delete the
pass outright from projects that take no money rather than carry it as a
permanently skipped row. That is this file's own rule about passes applied to
itself.

Also marked *(precautionary)*: the evidence is borrowed, not ours. It comes from
auditors of AI-built applications, one of whom names it the single thing they
most often fix, and from a report of a refund defect costing a financial
institution six figures a month. The two markers are deliberately separate --
applicability says whether to keep the pass, provenance says whether to argue
with it.

closes #3

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/qa/ClaudeQACoverage.md

@@ -24,6 +24,7 @@ Review trigger: Any QA round run
 | F — Accessibility | Not run | <why, and when it will be> |
 | G — Performance | Pass | <the numbers, not "felt fine"> |
 | H — Authorization and abuse | Not run | <which of the six cases were exercised, and as which user> |
+| I — Money flowing backwards | Not run | <only where money moves — delete this row otherwise, do not carry it as skipped> |
 
 ## Standing gaps
 

docs/qa/ClaudeQAPlan.md

@@ -34,6 +34,7 @@ skipped one is visible.
 | F | Accessibility: keyboard only, screen reader labels, contrast, text scaling |
 | G | Performance under the load this product will actually see |
 | H | Authorization and abuse: every authenticated endpoint called logged-out; a list endpoint checked for rows the caller should not see; User A requesting User B's object by id; a privileged route opened as an ordinary user; the most expensive endpoint hit repeatedly; the built bundle and `localStorage` inspected for anything secret |
+| I | *(only where money moves)* Money flowing backwards: refund, chargeback, cancellation and failed renewal each take away what the purchase gave |
 
 <Add, remove and rename to fit. A pass that never applies is noise; a pass that
 is always skipped is a lie.>
@@ -55,6 +56,22 @@ things.
 Run H as somebody who is not entitled: logged out, logged in as the wrong
 person, and logged in as the right person asking too often.
 
+### Why I is conditional, and why it is here at all
+
+Pass B buys. Pass I unbuys, and it is the pass most often missing: builds
+implement the checkout-success webhook and leave every reverse path unhandled,
+so access is granted once and never revoked. Refunded, charged back, cancelled,
+failed renewal — the money went back and the entitlement did not.
+
+*(precautionary)* — this one is **not** learned here. It comes from people who
+audit these applications for a living, one of whom calls it the single thing
+they most often fix, and from a report of a refund defect costing a financial
+institution six figures a month. Borrowed evidence is still evidence, but the
+marker says which it is so nobody mistakes it for our own scar.
+
+**Delete this pass outright if the project takes no money.** Keeping it as a
+permanently skipped row is the lie this file warns about two paragraphs up.
+
 ## What counts as a finding
 
 A finding needs: what was done, what happened, what should have happened, and