diff --git a/docs/qa/ClaudeQACoverage.md b/docs/qa/ClaudeQACoverage.md
index 723d53d..3f3d17f 100644
--- a/docs/qa/ClaudeQACoverage.md
+++ b/docs/qa/ClaudeQACoverage.md
@@ -24,6 +24,7 @@ Review trigger: Any QA round run
 | F — Accessibility | Not run | <why, and when it will be> |
 | G — Performance | Pass | <the numbers, not "felt fine"> |
 | H — Authorization and abuse | Not run | <which of the six cases were exercised, and as which user> |
+| I — Money flowing backwards | Not run | <only where money moves — delete this row otherwise, do not carry it as skipped> |
 
 ## Standing gaps
 
diff --git a/docs/qa/ClaudeQAPlan.md b/docs/qa/ClaudeQAPlan.md
index c8e5366..8ec3b16 100644
--- a/docs/qa/ClaudeQAPlan.md
+++ b/docs/qa/ClaudeQAPlan.md
@@ -34,6 +34,7 @@ skipped one is visible.
 | F | Accessibility: keyboard only, screen reader labels, contrast, text scaling |
 | G | Performance under the load this product will actually see |
 | H | Authorization and abuse: every authenticated endpoint called logged-out; a list endpoint checked for rows the caller should not see; User A requesting User B's object by id; a privileged route opened as an ordinary user; the most expensive endpoint hit repeatedly; the built bundle and `localStorage` inspected for anything secret |
+| I | *(only where money moves)* Money flowing backwards: refund, chargeback, cancellation and failed renewal each take away what the purchase gave |
 
 <Add, remove and rename to fit. A pass that never applies is noise; a pass that
 is always skipped is a lie.>
@@ -55,6 +56,22 @@ things.
 Run H as somebody who is not entitled: logged out, logged in as the wrong
 person, and logged in as the right person asking too often.
 
+### Why I is conditional, and why it is here at all
+
+Pass B buys. Pass I unbuys, and it is the pass most often missing: builds
+implement the checkout-success webhook and leave every reverse path unhandled,
+so access is granted once and never revoked. Refunded, charged back, cancelled,
+failed renewal — the money went back and the entitlement did not.
+
+*(precautionary)* — this one is **not** learned here. It comes from people who
+audit these applications for a living, one of whom calls it the single thing
+they most often fix, and from a report of a refund defect costing a financial
+institution six figures a month. Borrowed evidence is still evidence, but the
+marker says which it is so nobody mistakes it for our own scar.
+
+**Delete this pass outright if the project takes no money.** Keeping it as a
+permanently skipped row is the lie this file warns about two paragraphs up.
+
 ## What counts as a finding
 
 A finding needs: what was done, what happened, what should have happened, and