When an order breaks, the hard question is usually not what went wrong. It is who allowed this, and when. If the rules for moving an order from paid to shipped to refunded sit as conditions spread across half a dozen services, probably nobody can answer that without reading code.
We now declare the states and the allowed transitions as plain data, with rules about who may trigger what. The system either applies the change or refuses it with a stated reason, and every applied change lands in a history nobody can edit afterwards.
We are curious how your team answers the "who allowed this" question today. https://shipmindlabs.com/c/f732b545