@integraledger/lcp-binding-evm-x402 0.10.1 → 0.12.0

package/CHANGELOG.md

@@ -1,5 +1,65 @@
 # @integraledger/lcp-binding-evm-x402
 
+## 0.12.0
+
+### Patch Changes
+
+- Updated dependencies
+  - @integraledger/lcp-kernel@0.12.0
+  - @integraledger/lcp-binding-core@0.12.0
+  - @integraledger/lcp-binding-evm-common@0.12.0
+
+## 0.10.2
+
+### Patch Changes
+
+- b2ffecc: Report the class a record actually supports, place a terms URL on UCP, and stop refusing a conformant UCP
+  profile — the remediation of the 2026-08-19 conformance re-audit.
+
+  **`verify` now computes `supportedClass` instead of echoing the claim.** It was `anyFailed ? "TC-0" :
+claimedClass`, so a record proving nothing — no settlement, no acceptance, no authority chain — reported
+  whatever class the caller named, while the field's own published docblock promised "what the record
+  honestly supports, not what the caller asked for". It is now the highest class every one of whose required
+  steps is `proved`, `TC-0` on any failure, computed from the steps alone: neither capped by the claim (rungs
+  that reach TC-3 read TC-3 where the caller claimed TC-2) nor lifted by it. White paper #4 §5 defines the
+  class of a transaction as "the highest class whose criteria it fully meets", and this is that.
+
+  The claim is not discarded — the report gains **`claimedClass`**, a required member, because `verified`
+  answers "did the record reach the class it claimed?" and cannot be read without it. The two fields are the
+  report's two halves: an input echoed, and a finding computed. Where they differ, the record did not reach
+  its own shape. An out-of-taxonomy claim now lands only in the echo and can no longer masquerade as a
+  finding.
+
+  **UCP can advertise a terms URL.** Its policy object declares `url` — "Optional link to the full policy
+  document", `format: uri` — on the very entry this placement writes, and §C.3's illustration carries `url`
+  and `atrHash` side by side there. The manifest previously said the protocol had no slot, citing `links[]`,
+  which §C.3 separates as "a standing page, not a per-transaction record". The obstacle was mechanical:
+  `termsUrlFields` addresses document paths, and a tagged-array entry's index is chosen at write time. The
+  `tagged-array` container therefore gains `termsUrlField`, written onto the same entry in the same write, and
+  read back through the same first-match rule. UCP was the last shipped protocol that refused an
+  advertisement carrying its own locator (integra-protocol#8).
+
+  **`readUcpProfile` no longer refuses a conformant business profile.** `requireHttps` mapped an ABSENT `spec`
+  to the same branch as a malformed one, and the live host requires `spec` only of a platform declaration —
+  as this repository's own README already said. It is now `requireHttpsIfDeclared`: absence is absence, and a
+  declared value is still held to the host's https MUST.
+
+  Also: `requireWritten` replaces an unchecked cast in the x402 override, so a broken postcondition throws
+  instead of returning a success carrying no document; six x402 citations move to the revision that actually
+  touches the file they name, and a new gate refuses any `owner/repo@sha` in source that `spec-pins.json` does
+  not record; four spec citations move from line anchors to section anchors; the escrow binding states why it
+  declares no §8.3.1 off-canonical variant, and asserts it; and §C.3's `policies[]` illustration is recorded as
+  invalid against the live UCP schema, which shows `description` as a bare string where the host requires an
+  object — owed upstream, not a defect here.
+
+  Corpus 844 → 847, root `ec4ad1b02a81538b…`.
+
+- Updated dependencies [b2ffecc]
+- Updated dependencies [822190a]
+  - @integraledger/lcp-binding-core@0.11.0
+  - @integraledger/lcp-binding-evm-common@0.10.2
+  - @integraledger/lcp-kernel@0.11.0
+
 ## 0.10.1
 
 **0.10.0 was staged and withdrawn before approval; this is that release, re-cut.** The conformance corpus

package/dist/asset-transfer-method-filter.d.ts

@@ -4,7 +4,7 @@
  * 1. **Asset-transfer-method filter.** The atrHash-as-nonce weld rides ONLY on EIP-3009
  *    `transferWithAuthorization`, whose `nonce` is a payer-controlled 32-byte field committed on-chain in
  *    `AuthorizationUsed`. x402's `exact` scheme on EVM defines **three** methods, verified at
- *    `x402-foundation/x402@1fec3aa04e41`:
+ *    `x402-foundation/x402@db5da2e65952`, `specs/schemes/exact/scheme_exact_evm.md` (read 2026-08-11):
  *
  *      1. `eip3009`  — tokens with native `transferWithAuthorization` (the default when `extra` omits it)
  *      2. `permit2`  — tokens without it, via a proxy and the canonical Permit2 contract

package/dist/asset-transfer-method-filter.js

@@ -4,7 +4,7 @@
  * 1. **Asset-transfer-method filter.** The atrHash-as-nonce weld rides ONLY on EIP-3009
  *    `transferWithAuthorization`, whose `nonce` is a payer-controlled 32-byte field committed on-chain in
  *    `AuthorizationUsed`. x402's `exact` scheme on EVM defines **three** methods, verified at
- *    `x402-foundation/x402@1fec3aa04e41`:
+ *    `x402-foundation/x402@db5da2e65952`, `specs/schemes/exact/scheme_exact_evm.md` (read 2026-08-11):
  *
  *      1. `eip3009`  — tokens with native `transferWithAuthorization` (the default when `extra` omits it)
  *      2. `permit2`  — tokens without it, via a proxy and the canonical Permit2 contract

package/dist/constants.d.ts

@@ -17,9 +17,11 @@
  *   cast call <asset> "version()(string)"     --rpc-url <rpc>
  *   cast call <asset> "DOMAIN_SEPARATOR()(bytes32)" --rpc-url <rpc>
  *
- * **AN UPSTREAM MISMATCH, RECORDED HERE BECAUSE IT IS THE KIND THAT FAILS SILENTLY.** x402's own Go
- * implementation disagrees with the chain about Monad. Verified 2026-08-08 at
- * `x402-foundation/x402@1fec3aa04e41`, `go/mechanisms/evm/constants.go`: the `"eip155:143"` entry names
+ * **AN UPSTREAM MISMATCH, SINCE FIXED — recorded because it is the kind that fails silently.** x402's own
+ * Go implementation disagreed with the chain about Monad. Verified 2026-08-08 at
+ * `x402-foundation/x402@db9dabd0c674` — the last commit touching `go/mechanisms/evm/constants.go`, which is
+ * pinned as `x402-go` in `spec-pins.json` and is NOT the specification pin: the SDK and the specification
+ * are separate path sets that move on separate schedules. At that revision the `"eip155:143"` entry names
  * the SAME asset address as the `monad` entry below — `0x754704Bc059F8C67012fEd69BC8A327a5aafb603` — and
  * gives it EIP-712 domain `Name: "USD Coin"`. The deployed contract's `name()` returns `"USDC"`, which is
  * what the entry below carries and what the pinned `DOMAIN_SEPARATOR()` assertion in this repository holds
@@ -29,11 +31,14 @@
  * "USD Coin" against a contract reporting "USDC" produces an authorization that simply does not recover to
  * the payer. That is the silent failure this whole file exists to prevent, and here it is upstream.
  *
- * **REPORTED UPSTREAM 2026-08-08:** x402-foundation/x402#3102, with the `cast call` reproduction and the
- * observation that USDC deployments are not uniform on this — Base Sepolia and Monad report "USDC" while
- * Base mainnet and Avalanche report "USD Coin", so a value copied between chains yields a wrong domain
- * separator rather than an obvious error. Our entry stays as measured whatever upstream does: the token
- * contract computes the separator, so the chain is the authority.
+ * **REPORTED UPSTREAM 2026-08-08 and FIXED 2026-08-10:** x402-foundation/x402#3102, with the `cast call`
+ * reproduction and the observation that USDC deployments are not uniform on this — Base Sepolia and Monad
+ * report "USDC" while Base mainnet and Avalanche report "USD Coin", so a value copied between chains yields
+ * a wrong domain separator rather than an obvious error. `76bda78ef420` (PR #3105) changed the Go entry to
+ * `"USDC"`, matching the chain and matching the row below. The account is kept because the failure mode is
+ * the reason this file exists at all, and because the pin above is what a reader would otherwise re-derive.
+ * Our entry never depended on the outcome: the token contract computes the separator, so the chain was and
+ * remains the authority.
  *
  * **What this file is not.** It is not an endorsement of a rail, an allowlist, or a supported-chain list.
  * `createX402Adapter` takes any `X402AdapterConfig`, and a deployment absent here is not thereby refused —

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAC1B,MAAM,GACN,cAAc,GACd,WAAW,GACX,OAAO,CAAC;AAoCZ;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAajE;AAED,kFAAkF;AAClF,wBAAgB,mBAAmB,IAAI,kBAAkB,EAAE,CAE1D"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAC1B,MAAM,GACN,cAAc,GACd,WAAW,GACX,OAAO,CAAC;AAoCZ;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAajE;AAED,kFAAkF;AAClF,wBAAgB,mBAAmB,IAAI,kBAAkB,EAAE,CAE1D"}

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAyDA;;;;GAIG;AACH,MAAM,WAAW,GAAkD;IACjE,IAAI,EAAE;QACJ,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,4CAA4C;QACnD,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,GAAG;KAClB;IACD,qGAAqG;IACrG,qGAAqG;IACrG,cAAc,EAAE;QACd,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,4CAA4C;QACnD,SAAS,EAAE,MAAM;QACjB,YAAY,EAAE,GAAG;KAClB;IACD,SAAS,EAAE;QACT,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,4CAA4C;QACnD,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,GAAG;KAClB;IACD,KAAK,EAAE;QACL,OAAO,EAAE,GAAG;QACZ,KAAK,EAAE,4CAA4C;QACnD,SAAS,EAAE,MAAM;QACjB,YAAY,EAAE,GAAG;KAClB;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,oGAAoG;IACpG,iFAAiF;IACjF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC;QAC7C,CAAC,CAAC,WAAW,CAAC,IAA0B,CAAC;QACzC,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,MAAM,KAAK,SAAS;QACtB,MAAM,IAAI,KAAK,CACb,4BAA4B,IAAI,cAAc,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACnF,oGAAoG;YACpG,8FAA8F,CACjG,CAAC;IACJ,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,mBAAmB;IACjC,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAyB,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AA8DA;;;;GAIG;AACH,MAAM,WAAW,GAAkD;IACjE,IAAI,EAAE;QACJ,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,4CAA4C;QACnD,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,GAAG;KAClB;IACD,qGAAqG;IACrG,qGAAqG;IACrG,cAAc,EAAE;QACd,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,4CAA4C;QACnD,SAAS,EAAE,MAAM;QACjB,YAAY,EAAE,GAAG;KAClB;IACD,SAAS,EAAE;QACT,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,4CAA4C;QACnD,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,GAAG;KAClB;IACD,KAAK,EAAE;QACL,OAAO,EAAE,GAAG;QACZ,KAAK,EAAE,4CAA4C;QACnD,SAAS,EAAE,MAAM;QACjB,YAAY,EAAE,GAAG;KAClB;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,oGAAoG;IACpG,iFAAiF;IACjF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC;QAC7C,CAAC,CAAC,WAAW,CAAC,IAA0B,CAAC;QACzC,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,MAAM,KAAK,SAAS;QACtB,MAAM,IAAI,KAAK,CACb,4BAA4B,IAAI,cAAc,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACnF,oGAAoG;YACpG,8FAA8F,CACjG,CAAC;IACJ,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,mBAAmB;IACjC,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAyB,CAAC;AAC1D,CAAC"}

package/dist/manifest.js

@@ -23,7 +23,7 @@ export const X402_MANIFEST = {
     indexing: "nonce-topic:AuthorizationUsed",
     finality: {
         reversible: false,
-        note: "instant, final settlement (EIP-3009) — no on-rail reversal; recourse is the record's elected forum, and finality is never represented as dispute resolution (PAY-3/RCS-5) The atrHash welded as the EIP-3009 nonce MUST be per-transaction: an EIP-3009 nonce is one-time use, so one payer paying twice under the same ATR reproduces the same authorization and the token rejects the second with no LCP-level diagnostic. LCP §6.1 wants a per-transaction ATR anyway.",
+        note: "instant, final settlement (EIP-3009) — no on-rail reversal; recourse is the record's elected forum, and finality is never represented as dispute resolution (PAY-3/RCS-5). The atrHash welded as the EIP-3009 nonce MUST be per-transaction: an EIP-3009 nonce is one-time use, so one payer paying twice under the same ATR reproduces the same authorization and the token rejects the second with no LCP-level diagnostic. LCP §6.1 wants a per-transaction ATR anyway.",
     },
     // The payer's EIP-3009 signature commits to the nonce (= atrHash): signature-grade weld.
     weldGrades: { ERC3009: "signature" },

package/dist/manifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAoB;IAC5C,IAAI,EAAE,UAAU;IAChB,QAAQ,EAAE,MAAM;IAChB,OAAO,EAAE,cAAc;IACvB,WAAW,EAAE,eAAe;IAC5B,QAAQ,EAAE;QACR,OAAO,EAAE,IAAI;QACb,oBAAoB,EAAE,IAAI;QAC1B,gBAAgB,EAAE,IAAI;KACvB;IACD,YAAY,EAAE,UAAU,EAAE,2FAA2F;IACrH,WAAW,EAAE,YAAY,EAAE,gFAAgF;IAC3G,QAAQ,EAAE,+BAA+B;IACzC,QAAQ,EAAE;QACR,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE,2cAA2c;KACld;IACD,yFAAyF;IACzF,UAAU,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE;IACpC,YAAY,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,gBAAgB;IACpE,wGAAwG;IACxG,qGAAqG;IACrG,kGAAkG;IAClG,eAAe,EAAE,CAAC,UAAU,EAAE,gBAAgB,CAAC;CAChD,CAAC"}
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAoB;IAC5C,IAAI,EAAE,UAAU;IAChB,QAAQ,EAAE,MAAM;IAChB,OAAO,EAAE,cAAc;IACvB,WAAW,EAAE,eAAe;IAC5B,QAAQ,EAAE;QACR,OAAO,EAAE,IAAI;QACb,oBAAoB,EAAE,IAAI;QAC1B,gBAAgB,EAAE,IAAI;KACvB;IACD,YAAY,EAAE,UAAU,EAAE,2FAA2F;IACrH,WAAW,EAAE,YAAY,EAAE,gFAAgF;IAC3G,QAAQ,EAAE,+BAA+B;IACzC,QAAQ,EAAE;QACR,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE,4cAA4c;KACnd;IACD,yFAAyF;IACzF,UAAU,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE;IACpC,YAAY,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,gBAAgB;IACpE,wGAAwG;IACxG,qGAAqG;IACrG,kGAAkG;IAClG,eAAe,EAAE,CAAC,UAAU,EAAE,gBAAgB,CAAC;CAChD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integraledger/lcp-binding-evm-x402",
-  "version": "0.10.1",
+  "version": "0.12.0",
   "description": "Welds an ATR hash into an x402 instant settlement on any EVM chain.",
   "keywords": [
     "lcp",
@@ -45,9 +45,9 @@
   "homepage": "https://github.com/IntegraLedger/integra-protocol/tree/main/packages/binding-evm-x402#readme",
   "dependencies": {
     "viem": "2.55.11",
-    "@integraledger/lcp-binding-core": "0.10.1",
-    "@integraledger/lcp-kernel": "0.10.1",
-    "@integraledger/lcp-binding-evm-common": "0.10.1"
+    "@integraledger/lcp-binding-core": "0.12.0",
+    "@integraledger/lcp-binding-evm-common": "0.12.0",
+    "@integraledger/lcp-kernel": "0.12.0"
   },
   "devDependencies": {
     "@types/node": "24.13.3",

package/src/asset-transfer-method-filter.ts

@@ -4,7 +4,7 @@
  * 1. **Asset-transfer-method filter.** The atrHash-as-nonce weld rides ONLY on EIP-3009
  *    `transferWithAuthorization`, whose `nonce` is a payer-controlled 32-byte field committed on-chain in
  *    `AuthorizationUsed`. x402's `exact` scheme on EVM defines **three** methods, verified at
- *    `x402-foundation/x402@1fec3aa04e41`:
+ *    `x402-foundation/x402@db5da2e65952`, `specs/schemes/exact/scheme_exact_evm.md` (read 2026-08-11):
  *
  *      1. `eip3009`  — tokens with native `transferWithAuthorization` (the default when `extra` omits it)
  *      2. `permit2`  — tokens without it, via a proxy and the canonical Permit2 contract

package/src/constants.ts

@@ -17,9 +17,11 @@
  *   cast call <asset> "version()(string)"     --rpc-url <rpc>
  *   cast call <asset> "DOMAIN_SEPARATOR()(bytes32)" --rpc-url <rpc>
  *
- * **AN UPSTREAM MISMATCH, RECORDED HERE BECAUSE IT IS THE KIND THAT FAILS SILENTLY.** x402's own Go
- * implementation disagrees with the chain about Monad. Verified 2026-08-08 at
- * `x402-foundation/x402@1fec3aa04e41`, `go/mechanisms/evm/constants.go`: the `"eip155:143"` entry names
+ * **AN UPSTREAM MISMATCH, SINCE FIXED — recorded because it is the kind that fails silently.** x402's own
+ * Go implementation disagreed with the chain about Monad. Verified 2026-08-08 at
+ * `x402-foundation/x402@db9dabd0c674` — the last commit touching `go/mechanisms/evm/constants.go`, which is
+ * pinned as `x402-go` in `spec-pins.json` and is NOT the specification pin: the SDK and the specification
+ * are separate path sets that move on separate schedules. At that revision the `"eip155:143"` entry names
  * the SAME asset address as the `monad` entry below — `0x754704Bc059F8C67012fEd69BC8A327a5aafb603` — and
  * gives it EIP-712 domain `Name: "USD Coin"`. The deployed contract's `name()` returns `"USDC"`, which is
  * what the entry below carries and what the pinned `DOMAIN_SEPARATOR()` assertion in this repository holds
@@ -29,11 +31,14 @@
  * "USD Coin" against a contract reporting "USDC" produces an authorization that simply does not recover to
  * the payer. That is the silent failure this whole file exists to prevent, and here it is upstream.
  *
- * **REPORTED UPSTREAM 2026-08-08:** x402-foundation/x402#3102, with the `cast call` reproduction and the
- * observation that USDC deployments are not uniform on this — Base Sepolia and Monad report "USDC" while
- * Base mainnet and Avalanche report "USD Coin", so a value copied between chains yields a wrong domain
- * separator rather than an obvious error. Our entry stays as measured whatever upstream does: the token
- * contract computes the separator, so the chain is the authority.
+ * **REPORTED UPSTREAM 2026-08-08 and FIXED 2026-08-10:** x402-foundation/x402#3102, with the `cast call`
+ * reproduction and the observation that USDC deployments are not uniform on this — Base Sepolia and Monad
+ * report "USDC" while Base mainnet and Avalanche report "USD Coin", so a value copied between chains yields
+ * a wrong domain separator rather than an obvious error. `76bda78ef420` (PR #3105) changed the Go entry to
+ * `"USDC"`, matching the chain and matching the row below. The account is kept because the failure mode is
+ * the reason this file exists at all, and because the pin above is what a reader would otherwise re-derive.
+ * Our entry never depended on the outcome: the token contract computes the separator, so the chain was and
+ * remains the authority.
  *
  * **What this file is not.** It is not an endorsement of a rail, an allowlist, or a supported-chain list.
  * `createX402Adapter` takes any `X402AdapterConfig`, and a deployment absent here is not thereby refused —

package/src/manifest.ts

@@ -25,7 +25,7 @@ export const X402_MANIFEST: BindingManifest = {
   indexing: "nonce-topic:AuthorizationUsed",
   finality: {
     reversible: false,
-    note: "instant, final settlement (EIP-3009) — no on-rail reversal; recourse is the record's elected forum, and finality is never represented as dispute resolution (PAY-3/RCS-5) The atrHash welded as the EIP-3009 nonce MUST be per-transaction: an EIP-3009 nonce is one-time use, so one payer paying twice under the same ATR reproduces the same authorization and the token rejects the second with no LCP-level diagnostic. LCP §6.1 wants a per-transaction ATR anyway.",
+    note: "instant, final settlement (EIP-3009) — no on-rail reversal; recourse is the record's elected forum, and finality is never represented as dispute resolution (PAY-3/RCS-5). The atrHash welded as the EIP-3009 nonce MUST be per-transaction: an EIP-3009 nonce is one-time use, so one payer paying twice under the same ATR reproduces the same authorization and the token rejects the second with no LCP-level diagnostic. LCP §6.1 wants a per-transaction ATR anyway.",
   },
   // The payer's EIP-3009 signature commits to the nonce (= atrHash): signature-grade weld.
   weldGrades: { ERC3009: "signature" },