# Spec delta: order

## ADDED Requirements

### Requirement: Checkout splits by shop
`POST /api/orders/checkout` SHALL create one order per distinct shop in the cart, in a single database transaction: stock decrement, order + item insert with price snapshots, cart clear. All amounts use the cart's SKU currencies converted into the buyer-chosen display currency at checkout time.

#### Scenario: two shops → two orders
- **WHEN** the cart contains SKUs from shops A and B
- **THEN** two orders are created, each with only its shop's items, and the cart is empty

#### Scenario: insufficient stock
- **WHEN** any line's qty exceeds SKU stock
- **THEN** the whole checkout returns 409 and no order is created and stock is unchanged

### Requirement: Order lifecycle
Status transitions SHALL be: pending_payment → paid → fulfilling → shipped → completed; cancellable only from pending_payment, which MUST restore stock.

#### Scenario: cancel restores stock
- **WHEN** a customer cancels a pending_payment order
- **THEN** stock of each SKU increases by the ordered qty and status is cancelled

#### Scenario: illegal transition rejected
- **WHEN** cancelling a paid order via the customer endpoint
- **THEN** the API returns 409

### Requirement: Order ownership
Customers SHALL see only their own orders; shop roles only their shop's orders; platform_admin sees all.

#### Scenario: cross-customer read denied
- **WHEN** customer X requests customer Y's order id
- **THEN** the API returns 404