–Security: returns and RMA cases can no longer be advanced or refunded by a request the shop screen never offered. One authorisation check now governs every action, and the buttons and the request handler read the same rule, so they cannot drift apart.
–A refund is refused unless the return has been approved first — previously a refund could be issued before the shop had approved the case or received the goods.
–Your rule settings are now enforced, not just displayed: unticking Refund, Repair or Exchange really disables it. Note that Repair and Exchange cards were previously shown regardless of those checkboxes, so a shop that had unticked one will stop seeing that card.
–Free installations can no longer have RMA cases advanced, rules deleted, or orders cancelled through the returns endpoints.