# description
Backward-compatible customer-controlled compare-and-set journal with pre-consume ownership, recoverable consume ambiguity, provider-intent leases, provider-input binding, and optional v3 signed execution-permit redemption evidence. It must never contain payment credentials, private keys or provider client secrets.

# properties.execution_mode.description
Presence selects the provider-bound v3 path. Absence is the backward-compatible legacy direct-CONSUME path.

# properties.consume_transitioned_at.description
Hosted CONSUME transition time, or the conservative local receipt time when an older compatible processor omits it. Provider evidence earlier than this boundary is never finalized.

# properties.settlement_deadline_at.description
Exact epoch-millisecond release and safe first-submission deadline returned by CONSUME. No new provider submission may start afterward. Read-only reconciliation may continue, but only COMMITTED can finalize after the deadline; RELEASE is never attempted late.

# properties.provider_intent_abandoned_at.description
Durable provenance that an expired provider-intent lease was marked abandoned before recovery. Absence or failure may release only with provider_submission_fenced=true and only before settlement_deadline_at.

# properties.provider_submission_fenced.description
The provider adapter proved that every earlier ambiguous submit can no longer commit.