Extension execution boundaries

Only operations listed in the verified API Reference are public. An extension cannot set payment, order, refund, delivery, or fulfillment facts directly, and it cannot treat a timeout or unreadable response as success.

Requests must use the operation's documented authentication, authorization, idempotency, and retry semantics. A missing public operation remains unavailable; clients must not infer an endpoint or result from UI behavior, Webhook timing, or another integration.

Configuration, credentials, execution internals, and infrastructure are intentionally outside this public documentation. They must never enter browser bundles, URLs, logs, analytics, or support messages.

Use only published operations and Webhook events. Production enablement and real execution evidence remain separate acceptance steps.