docs: record config-getter decision; close #195 #171 #170 #169

[aurorabini]

Summary

This PR closes the four assigned accensa-contracts issues. All four are already
implemented on main (the issues were never marked closed), so this PR is
intentionally small: it documents the state with evidence per issue and adds the
one thing that was genuinely missing — the design-decision argument issue #195
explicitly asked the implementer to record.

#171 — CI runs cargo without --locked

Already resolved on main. .github/workflows/ci.yml runs cargo clippy --all-targets --locked -- -D warnings, cargo test --workspace --locked, cargo build --locked --target wasm32v1-none --release, and the receipt-shard builds with --locked; all actions/cache steps are v4; and CONTRIBUTING.md documents that Cargo.lock is committed deliberately and must be updated in the same commit as a dependency change. CI fails rather than silently resolving against a drifted lockfile.

#170 — unused storage keys and error variants

Already resolved on main. RefundVault's DataKey no longer declares Metadata, RefundMax, Admins, or Threshold — the leftover keys pointing at deliberately-unbuilt features (#31, #97, #101) are gone. The unreachable MetadataTooLong / AmountExceedsMax error variants are removed; the surviving error discriminants keep their numeric values.

#169 — refund window / paid_at_ledger

Already resolved on main. refund rejects a future paid_at_ledger (paid_at_ledger > env.ledger().sequence() ⇒ Error::FuturePaidAtLedger) before evaluating the window (contracts/refund-vault/src/lib.rs, in refund), so a merchant cannot widen the window by restating the ledger. The decision is recorded: docs/ADR-005-refund-window.md + a SECURITY_MODEL.md "Window Expiry Evasion" section state that the window constrains the merchant's refund authority inside the reported paid_at_ledger, not an absolute on-chain fact. Tests named for the chosen semantics assert it directly:

• refund_rejects_future_paid_at_ledger
• merchant_cannot_use_future_paid_at_ledger_to_widen_window
• plus test_refund_outside_window_fails, test_refund_at_window_boundary_succeeds, test_zero_window_disables_expiry.

#195 — config values unreadable on-chain

Already resolved on main (individual getters, not a batch get_config): get_admin, get_token, get_refund_window, is_paused on RefundVault and get_admin, get_pruned_up_to on ReceiptAnchor. All return Error::NotInitialized on an uninitialized contract instead of trapping, and are documented in the README function tables.

What was missing and this PR adds: issue #195 asked the implementer to argue for the getter shape. That argument was nowhere recorded. This PR adds a short design note to the README (after the RefundVault getter table) explaining why individual read-only getters were chosen over a single struct-returning get_config (compositional, ABI-stable as config grows, and the is_paused uninitialized-vs-false distinction wouldn't survive aggregation).

Scope / checks

• Documentation-only change (README.md); no contracts/*/src touched, so no CHANGELOG entry required under the CI changelog rule.
• No contract code changed, so cargo test/clippy/fmt outcomes on main are unaffected by this PR.

Closes #195
Closes #171
Closes #170
Closes #169

[drips-wave]

@aurorabini Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[mergekeeper]

MergeKeeper review

Scope: in scope for linked issue #195.
Verdict: clean

The pull request correctly records the configuration-getter design decision in README.md as requested by issue #195, matching repository documentation conventions.

Reviewed commit: 2a1ff67893eedd334d3c5ef302eddcffbf313ea0.
CI and merge eligibility are checked separately.

[mergekeeper]

MergeKeeper merge status

Status: blocked
PR state: closed
Mergeability: unknown
Checked commit: 2a1ff67893eedd334d3c5ef302eddcffbf313ea0.

Reason: One or more required CI checks failed.

Failing checks:

• test - view details
• build-wasm - view details

Next steps:

1. Open the failing check details above and fix the reported error.
2. Run the same checks locally where possible.
3. Commit and push the fix.
4. MergeKeeper will automatically re-review the updated PR.