Decline to pay for one case.

Four properties, all of them load-bearing:

1. paid is a 409. The money already left; a refund is a treasury operation and out of scope here. Voiding it would leave the ledger saying we owe nothing for work we have already disbursed.
2. Idempotent on earning_id — a double-click cannot double-decrement, because the store's guarded UPDATE is the arbiter rather than a read.
3. The recomputed total comes back, so the console renders the ledger's number instead of subtracting its own.
4. An audit row, because voiding a physician's pay is consequential and must be attributable to the person who did it.