A purchase records intent, checkout approval, wallet approval reference, one payment attempt, reconciliation, and merchant-order confirmation as separate facts. A wallet approval is not proof of payment, and payment is not proof that the merchant created an order.
States
| Phase | States |
|---|---|
| Research and login | CREATED, RESEARCHING, LOGIN_REQUIRED |
| Checkout and consent | CHECKOUT_READY, HUMAN_CONFIRMATION_REQUIRED |
| Wallet | WALLET_APPROVAL_REQUIRED, WALLET_APPROVED, PAYMENT_MATERIAL_READY |
| Commit and verification | COMMITTING, RECONCILING, PAID, ORDER_CONFIRMED |
| Terminal or exceptional | CANCELLED, FAILED, OUTCOME_UNKNOWN |
Every public response includes a redacted purchase projection and a revision. A write based on stale state is refused rather than silently overriding a newer decision.
Commit boundary
Before COMMITTING, a purchase can be cancelled and a human may claim the browser handoff. After the commit boundary, cancellation becomes reconciliation of the original attempt; the system must not create a second payment attempt automatically.
Boundaries
- The current intent schema accepts
USDand a positivemaxTotalUsdMicros. - One database constraint permits at most one payment attempt per purchase.
- A shipping address reaches the ledger only by opaque reference.
- Payment and merchant-order execution are not exposed as public executor routes.