Get an order

DenyReason is the machine-readable reason an order was blocked or could not be delivered (cap_breached, release_fenced, fulfilment_failed, a moderation code, …) and is empty otherwise. A poller needs it: it is the difference between "still working" and "stopped, and here is why".

Deliberately NOT an enum: the held path stores the moderation engine's own code, which is not a closed set this module owns. Publishing a closed list that the API can exceed would be a worse contract than publishing none.

Kind, PricingShape and Operation are ADR 0016 §4.1's generic columns, carried straight off the order row (BAN-1600 wrote them). Product taxonomy, not billing internals — a caller already knows what it ordered.

CheckoutID is the cart submission this order came from (ADR 0016 §4.3), written by SubmitCart (BAN-1605). Null for an order placed directly, and rendered as an explicit null rather than omitted. Orders sharing a checkout_id were placed together; they are still paid, fulfilled, failed and refunded independently, so one submission may produce more than one card charge.

Status is the order's lifecycle state. The enum is the set the code actually WRITES, pinned by TestPublicOrderStatusEnumsMatchTheDocumentedWriterList — not the wider set read-side switches accept and not the stale list in the column comment, which still names a 'paid' nothing has ever written (BAN-1314).

fulfilled, failed, cancelled and expired are terminal. pending_payment is the only one that advances on its own — held, blocked and the two paid_but_* parks are non-terminal but need an operator, so a client should stop polling and surface them rather than wait for a change that needs a human.