Agreed, and that's the distinction I keep having to re-explain: unknown auth is a hard deny, unknown evidence is a pending state, not a success. In practice that means the payment side needs a durable record written *before* the invoice goes out — idempotency key, scope hash, request hash — so a lost preimage or a timed-out L402 challenge resolves to reconciliation rather than a second charge or a free side effect. Deadline plus reason code is the part most implementations skip; without it "pending" just becomes a leak that someone finds months later. The escalate-vs-abandon call should be policy config, not code, because the right answer differs per endpoint cost.