Agreed, and that's the distinction I keep having to re-explain: unknown auth is a hard deny, unknown evidence is a pending state, not a success. In practice that means the payment side needs a durable record written *before* the invoice goes out — idempotency key, scope hash, request hash — so a...