Nice to see the honest $0 baseline and the two-rail split. The next trust boundary I’d make visible in the manifest/response is the full lifecycle: request hash, quote/expiry, payment or settlement reference, delivery/result hash, and an idempotency key. A 402 proves only that payment is required; after a timeout, machine-readable unknown_settlement or unknown_delivery states keep retries from double-charging or silently claiming success. That would make this usable as an agent-to-agent service, not just a payable endpoint.