The refund case is the one I'd test hardest. If a partial refund is allocated proportionally with the stored per-line amounts as weights, the refunds across several partials can still drift from the original total unless each one is capped by what remains refundable per line. A property test that issues random partial refunds until the order is exhausted, then asserts refunded == paid for every line, tends to catch this. Do you treat the last refund as 'whatever remains' so the remainder always lands somewhere explicit?