CROSS-SYSTEM PAYMENT PROOF CARD Ambiguous Payment Recovery Kit Reference: https://github.com/safal207/valta-pilot-lab The problem in one line ----------------------- A provider can prove the state of its own request. The hard part is proving ONE economic outcome across the provider, the external rail, the recipient, and the customer ledger before an automated retry is permitted. The four systems that must agree -------------------------------- PROVIDER -> EXTERNAL RAIL -> RECIPIENT -> CUSTOMER LEDGER request movement credit posting accepted? executed? received? recorded once? A verdict is only as strong as the weakest independently observed link. Evidence to collect per attempt ------------------------------- attempt_id unique per dispatch attempt intent_id stable across retries of the same economic intent reservation_owner durable owner token held before dispatch fencing_token monotonic; stale workers must be rejected authorization_binding amount + recipient + target + action provider_state accepted | rejected | timeout | unknown rail_effect observed externally, not inferred from the provider recipient_credit observed at destination where available ledger_posting linked to intent_id, exactly one receipt_digest integrity hash over the collected evidence Verdict rules ------------- VERIFIED Exactly one rail effect observed AND linked to exactly one ledger posting AND authorization binding matches AND receipt integrity passes. SAFE_TO_RETRY Zero rail effects observed AND a pre-effect rejection is proven (the request was refused before any movement) AND no ledger posting exists. UNVERIFIED Provider reports accepted, but the expected external effect is absent from independent observation. Investigate; do not auto-retry. RECONCILE_REQUIRED The effect may have happened, evidence sources disagree, or observation is unavailable. Blind retry remains blocked until reconciliation resolves it. Common failure patterns ----------------------- * Treating provider "accepted" as settlement finality. * Retrying on timeout with no fencing, producing two rail effects. * Idempotency keys scoped per request instead of per economic intent. * Ledger posting written from the caller's assumption, not observed effect. * No replayable evidence, so two operators reach two different conclusions. Boundary statement ------------------ This card is a method reference. It does not process payments, hold funds, or assert exactly-once execution outside a declared, published test boundary.