CONSUME OWNERSHIP
Claim locally before requesting remote authority
One compare-and-set transition to CONSUME_INTENT elects the only worker allowed to call the hosted CONSUME transition. Every process and region for the same gateway binding must use one globally shared, linearizable namespace for begin, get and compareAndSet. The runtime requires the explicit GLOBAL_SHARED_LINEARIZABLE declaration, but the customer must prove the backing store really provides it. Split-brain or per-region journals are unsafe. Parallel callers in a conforming deployment observe nonterminal state and cannot call either MandateShield or the payment provider.
LOST RESPONSE RECOVERY
Recover the same consume transition; never invent a new permit
If the CONSUME response is lost, the journal remains nonterminal. After the consume-intent lease, the Gate repeats only the same transition with the same idempotency key. It may continue when the hosted service confirms either a fresh permit or the exact idempotent transition still in CONSUMED. Other states remain unresolved and never unlock the provider.
PROVIDER OWNERSHIP
An active submission cannot be overwritten by reconciliation
The provider worker records PROVIDER_INTENT and its lease timestamp before the adapter starts. Parallel callers return pending during the lease. An abandoned intent becomes eligible for provider-specific reconciliation only after the configured lease; it is never resubmitted automatically.
Reconciliation has its own durable RECONCILE_INTENT lease. Only that owner may query the provider, so parallel or restarted workers cannot race contradictory settlement evidence into the journal.
HOSTED PROVIDER RECONCILIATION
A caller hint opens verification; it does not decide the state
Provider-bound CONSUME creates a signed permit and a prepared provider-submission record. One fresh online redemption binds the resulting claim_id, opens exactly one provider attempt and returns the durable provider_submission_id. The adapter must report those identifiers with the exact payment reference and bounded caller outcome to POST /api/v2/provider-submissions.
The report itself is CALLER_ASSERTED evidence. Hosted reconciliation independently checks the configured Stripe PaymentIntent or x402 canonical chain. Only exact, non-conflicting PROVIDER_API_VERIFIED or CHAIN_FINALIZED evidence with independent_verification=true may autonomously COMMIT or RELEASE and return a signed terminal receipt. Pending, unknown and conflicting evidence remains fail-closed and must continue reconciliation.
The direct manual terminal path remains supported. Its processor_result remains CALLER_ASSERTED with independent_verification=false, even when the PROCESSOR credential and all bindings are valid.
SETTLEMENT DEADLINE
The hosted consume deadline follows every provider operation
A fresh CONSUME response must include a future settlement_deadline_at exactly bound to its transition time. Gateway v2 persists that epoch-millisecond value before provider ownership and supplies it to the adapter on submit and reconciliation. Recovery may observe an already elapsed but correctly bounded deadline; that closes the journal as SUBMISSION_WINDOW_CLOSED and never unlocks the provider.
A canonical confirmed settlement may commit after the deadline, but failure or non-submission evidence may never release after it. Once a submission worker was abandoned or reconciliation began, release additionally requires submission_fenced=true: the adapter must prove no delayed worker can still submit. Unfenced absence remains OUTCOME_UNKNOWN.
IMMUTABLE BINDING
Provider input participates in journal identity
When present, canonical provider_input is SHA-256 bound into the operation identity. A changed payment method, challenge or paid request cannot reuse the original journal record. Provider create and confirm operations retain separate deterministic idempotency keys.
PUBLIC CONTRACT
Validate every durable record against v2
VERSION BOUNDARY
v1 remains published and unchanged
Gateway v2 adds journal states and fields that a closed-enum v1 consumer may not understand. The v1 schema remains frozen at its original URL. This vendor-authored contract and reference implementation are not an independent audit or accredited standard.