Implemented in the preview source
- Application-owned purchase intents and redacted state.
- Revision-checked checkout digest approval and pre-commit cancellation.
- Exclusive, origin-bound browser handoff leases.
- Persistent redacted events, one-attempt enforcement, budgets, wallet references, secure-input session records, refund records, and reconciliation records.
Not a production capability
- Arbitrary-site browser execution and cart completion.
- Production Link wallet integration.
- Production PayPal wallet integration for third-party merchants.
- Unattended payment completion.
- Storage or retrieval of passwords, OTPs, card numbers, CVVs, cookies, or wallet tokens.
- A public endpoint that hands payment material to an Agent.
Why the boundary is explicit
The ledger can enforce state, approval, and audit rules before execution adapters are safe to expose. Documentation must not turn an implemented record type into a claim that money movement works end to end.