{ "schema": "haltseal.public-control-tests.v1", "release": "0.1.0", "revision": 2, "published_date": "2026-09-28", "canonical_url": "https://haltseal.com/tests/payment-fallback-controls/", "scope": "Recorded synthetic local reference results; no actual customer or product performance claim.", "source": { "kit": "HALTSEAL Qualification Kit v0.4.2", "archive_sha256": "a156d5563c206c3d212d4e45a310f0023384e0d64d4bab46e40592ab61d54e75", "original_scenarios": 36, "original_executions": 144, "selected_scenarios": 16, "selected_executions": 64, "selection": "Illustrative subset; every model retained for each chosen scenario; not statistically representative.", "replay": "Selected findings recalculated with the unchanged source offline evaluator; 64 complete-result matches.", "access": "Original traces, evaluator and fresh-run kit are separate request-only materials under agreed sharing terms.", "external_independent_reproduction": false, "native_provider_calls": 0, "actual_buyer_paths": 0 }, "interpretation": { "decisions": [ "ACCEPT", "HOLD", "REFUSE" ], "qualifications": [ "PASS", "FAIL", "INCONCLUSIVE" ], "pass": "Satisfies the bounded recorded case; not a reliability percentage, product score or real-payment authorization.", "scope_limit": "One full USD 10,000 fictional obligation, two local routes, trusted local ordering and synthetic policy time.", "method": "https://haltseal.com/tests/payment-fallback-controls/#method" }, "modes": { "conserved": { "label": "Capable existing control", "description": "A hypothetical existing control that checks the modeled authority, prior attempts and execution boundary. It is not the HALTSEAL engine or an actual customer." }, "blocked": { "label": "Always blocks recovery", "description": "A fixture that holds every recovery request. It can satisfy a withholding case but fails when the case requires available safe progress." }, "unsafe": { "label": "Deliberately unsafe", "description": "A calibration fixture that intentionally omits selected safeguards. Other checks remain, so some individual cases still pass. It is not a competitor." }, "unobserved": { "label": "Handler not observed", "description": "A fixture with intentionally missing handler visibility. Uncertainty remains visible; independently established violations still fail." } }, "cases": [ { "case_id": "R01", "title": "Original payment already took effect", "group": "Effect and finality", "situation": "The original route A has a recorded full payment effect. An identical fallback is requested on route B.", "available_evidence": "The decision maker has evidence that the original paid before the backup was requested.", "recommended_decision": "REFUSE", "reason": "A second full payment is not available capacity for the same obligation.", "verification": "Confirm that the original already paid and no second full payment occurred across the two modeled routes.", "limit": "The local model covers one full payment. Returns, refunds and partial settlement require separate evaluation.", "observed": "Recorded request decisions: 1 REFUSE. Payment effects: 1 on A and 0 on B. Overall qualification: PASS.", "results": { "blocked": "PASS", "conserved": "PASS", "unobserved": "INCONCLUSIVE", "unsafe": "FAIL" } }, { "case_id": "R02", "title": "Original outcome is still unresolved", "group": "Effect and finality", "situation": "Route A remains capable of taking effect when an identical route B fallback is requested.", "available_evidence": "The original attempt is known, but there is no valid evidence that it has not paid and can no longer pay.", "recommended_decision": "HOLD", "reason": "An unresolved original can still consume the authorized payment capacity.", "verification": "Confirm that the original could still pay when the backup was requested and that the backup stayed on HOLD.", "limit": "A timeout or missing response is not itself proof of no effect. This fixture is not a provider timeout experiment.", "observed": "Recorded request decisions: 1 HOLD. Payment effects: 1 on A and 0 on B. Overall qualification: PASS.", "results": { "blocked": "PASS", "conserved": "PASS", "unobserved": "INCONCLUSIVE", "unsafe": "FAIL" } }, { "case_id": "R04", "title": "Safe fallback is available", "group": "Required progress", "situation": "Route A is closed without effect and fenced against later execution. The same authorized payment is requested on route B.", "available_evidence": "Fresh evidence for the exact original establishes that it cannot pay later. Current approval and declared coverage permit a fresh backup check.", "recommended_decision": "ACCEPT", "reason": "This declared case requires safe backup progress once the original can no longer pay.", "verification": "Confirm that the original could no longer pay, the exact backup remained authorized and one backup payment occurred in the capable model.", "limit": "The fixture supplies a permanent local fence. A native provider cancellation status alone does not establish this contract.", "observed": "Recorded request decisions: 1 ACCEPT. Payment effects: 0 on A and 1 on B. Overall qualification: PASS.", "results": { "blocked": "FAIL", "conserved": "PASS", "unobserved": "INCONCLUSIVE", "unsafe": "PASS" } }, { "case_id": "R06", "title": "Closure evidence has not reached the decision maker", "group": "Evidence available at decision", "situation": "The original can no longer pay, but evidence of that closure is unavailable to the decision maker when the backup is requested.", "available_evidence": "Only the earlier unresolved observation is available at the decision. Additional closure evidence is present in the retained review record.", "recommended_decision": "HOLD", "reason": "A correct decision cannot rely on evidence that was not available to the decision maker.", "verification": "Confirm that closure evidence was unavailable to the decision maker at the time and that the backup stayed on HOLD.", "limit": "No eventual route B progress is required until usable closure evidence arrives. This is a controlled delivery omission.", "observed": "Recorded request decisions: 1 HOLD. Payment effects: 0 on A and 0 on B. Overall qualification: PASS.", "results": { "blocked": "PASS", "conserved": "PASS", "unobserved": "INCONCLUSIVE", "unsafe": "FAIL" } }, { "case_id": "R10", "title": "Closure evidence is too old", "group": "Evidence available at decision", "situation": "A route A closure is presented after its permitted evidence age has elapsed.", "available_evidence": "Closure evidence is older than the permitted freshness window in this synthetic case and is rejected.", "recommended_decision": "HOLD", "reason": "A closure outside the declared freshness window cannot authorize this fallback.", "verification": "Confirm that evidence outside the permitted freshness window did not authorize backup release.", "limit": "Freshness uses synthetic policy time. This case does not recommend a production expiration interval.", "observed": "Recorded request decisions: 1 HOLD. Payment effects: 0 on A and 0 on B. Overall qualification: PASS.", "results": { "blocked": "PASS", "conserved": "PASS", "unobserved": "INCONCLUSIVE", "unsafe": "FAIL" } }, { "case_id": "R13", "title": "Closure refers to the wrong payment", "group": "Evidence binding", "situation": "Evidence presented as closure refers to a different payment from the registered original attempt.", "available_evidence": "The mismatched evidence is rejected. There is no usable closure evidence for the actual original.", "recommended_decision": "HOLD", "reason": "Evidence for a different payment does not close this original attempt.", "verification": "Confirm that closure evidence matches the original payment. Evidence for another payment must not authorize this backup.", "limit": "The public subset illustrates payment matching. Other mismatches involving the attempt or account remain in the full 36-scenario source suite.", "observed": "Recorded request decisions: 1 HOLD. Payment effects: 0 on A and 0 on B. Overall qualification: PASS.", "results": { "blocked": "PASS", "conserved": "PASS", "unobserved": "INCONCLUSIVE", "unsafe": "FAIL" } }, { "case_id": "R18", "title": "Closure does not prevent later execution", "group": "Evidence binding", "situation": "An observation resembles a terminal closure but does not establish that later execution is prevented.", "available_evidence": "The local closure evidence does not establish that the original is unable to pay later, so it is insufficient.", "recommended_decision": "HOLD", "reason": "A status label is insufficient without evidence that the original cannot pay later.", "verification": "Confirm that the evidence establishes that the original cannot pay later. Without that evidence, the backup must stay on HOLD.", "limit": "The fence is a simulator construct. This case makes no native Modern Treasury or Increase finality claim.", "observed": "Recorded request decisions: 1 HOLD. Payment effects: 0 on A and 0 on B. Overall qualification: PASS.", "results": { "blocked": "PASS", "conserved": "PASS", "unobserved": "INCONCLUSIVE", "unsafe": "FAIL" } }, { "case_id": "R19", "title": "Fallback amount changed", "group": "Authority and action", "situation": "The backup requests USD 10,000.01 instead of the authorized USD 10,000.", "available_evidence": "Current approval still specifies the original amount and exact payment.", "recommended_decision": "REFUSE", "reason": "This request is a different action and requires a new authorization decision.", "verification": "Confirm that the exact backup amount matches current approval. A changed amount must not inherit permission.", "limit": "The intentionally unsafe model also refuses this mismatch. A model name does not predetermine every result.", "observed": "Recorded request decisions: 1 REFUSE. Payment effects: 1 on A and 0 on B. Overall qualification: PASS.", "results": { "blocked": "PASS", "conserved": "PASS", "unobserved": "INCONCLUSIVE", "unsafe": "PASS" } }, { "case_id": "R21", "title": "Authority revoked before the request", "group": "Authority and action", "situation": "The fallback is requested after the active payment authority has been revoked.", "available_evidence": "Current approval is inactive when the backup is requested.", "recommended_decision": "REFUSE", "reason": "A previous authorization does not survive its recorded revocation.", "verification": "Confirm that approval was revoked before the backup request and the backup was refused.", "limit": "Authority publication is trusted within the local model; production propagation delay is not measured.", "observed": "Recorded request decisions: 1 REFUSE. Payment effects: 1 on A and 0 on B. Overall qualification: PASS.", "results": { "blocked": "PASS", "conserved": "PASS", "unobserved": "INCONCLUSIVE", "unsafe": "PASS" } }, { "case_id": "R23", "title": "Authority revoked after reservation", "group": "Authority and action", "situation": "A valid fallback is initially reserved. Authority is then revoked before source admission.", "available_evidence": "Closure and approval were valid when capacity was reserved. Approval was revoked before release.", "recommended_decision": "ACCEPT initially; REFUSE dispatch", "reason": "Reservation is not irrevocable permission to submit. Approval must still be current at release.", "verification": "Confirm that approval was revoked before release and the backup was neither submitted nor paid.", "limit": "This is one local ordering, not proof of distributed revocation or provider-side fencing.", "observed": "Recorded request decisions: 1 ACCEPT. Dispatch was refused after reservation. Payment effects: 0 on A and 0 on B. Overall qualification: PASS.", "results": { "blocked": "PASS", "conserved": "PASS", "unobserved": "INCONCLUSIVE", "unsafe": "PASS" } }, { "case_id": "R24", "title": "An execution boundary is declared uncovered", "group": "Coverage", "situation": "A safe-looking fallback is requested while the authority record explicitly says execution coverage is incomplete.", "available_evidence": "Closure evidence is available, but a payment path is explicitly outside validated coverage.", "recommended_decision": "HOLD", "reason": "The payment decision should hold, while overall qualification remains INCONCLUSIVE unless a definite violation is observed.", "verification": "Identify any payment path outside validated coverage. Keep uncertainty visible; an established violation remains FAIL.", "limit": "A held request does not prove that every external path is controlled. The unsafe model has a definite violation and therefore FAILs.", "observed": "Recorded request decisions: 1 HOLD. Payment effects: 0 on A and 0 on B. Overall qualification: INCONCLUSIVE.", "results": { "blocked": "INCONCLUSIVE", "conserved": "INCONCLUSIVE", "unobserved": "INCONCLUSIVE", "unsafe": "FAIL" } }, { "case_id": "R25", "title": "Manual payment bypasses the decision", "group": "Coverage", "situation": "A manual route B submission is injected outside the control while the original route remains exposed.", "available_evidence": "At the governed request, the original is unresolved and usable closure evidence is absent. A separate manual release occurs after HOLD, outside the governed path.", "recommended_decision": "HOLD the governed request", "reason": "A correct local decision cannot erase an actual payment admitted outside the declared control.", "verification": "Confirm that the manual payment occurred outside the governed release point and both routes paid. The overall result remains FAIL.", "limit": "All four models FAIL this injection, including the competent model. This is a negative test, not a claim that HALTSEAL prevented the bypass.", "observed": "Recorded request decisions: 1 HOLD. Payment effects: 1 on A and 1 on B. Overall qualification: FAIL.", "results": { "blocked": "FAIL", "conserved": "FAIL", "unobserved": "FAIL", "unsafe": "FAIL" } }, { "case_id": "R26", "title": "Concurrent requests compete for one backup", "group": "Concurrency", "situation": "Four local worker processes request the same valid fallback after route A has been safely closed.", "available_evidence": "The requests compete for one payment capacity under the declared local control contract.", "recommended_decision": "ACCEPT one; HOLD the others", "reason": "Exactly one live reservation may consume the capacity, while required route B progress must remain possible.", "verification": "Confirm that the competing requests produced one modeled reservation and one backup payment effect in the capable model.", "limit": "This is one bounded four-process schedule per model. It is not exhaustive scheduling, distributed consensus or a latency benchmark.", "observed": "Recorded request decisions: 1 ACCEPT, 3 HOLD. Payment effects: 0 on A and 1 on B. Overall qualification: PASS.", "results": { "blocked": "FAIL", "conserved": "PASS", "unobserved": "INCONCLUSIVE", "unsafe": "FAIL" } }, { "case_id": "R29", "title": "Execution stops after the backup is accepted", "group": "Crash recovery", "situation": "A local executor exits after route B accepts a submission and before normal acknowledgement completes.", "available_evidence": "The accepted backup remains identifiable in the retained local record, which is available during recovery.", "recommended_decision": "ACCEPT; recover the same job", "reason": "Recovery must identify the already accepted backup instead of creating fresh payment capacity.", "verification": "Confirm that recovery found the already accepted backup and completed the required progress without a second payment effect.", "limit": "Only local cases reaching backup acceptance were interrupted. Recovery here does not establish control of remote or still-running executors.", "observed": "Recorded request decisions: 1 ACCEPT. Payment effects: 0 on A and 1 on B. Overall qualification: PASS.", "results": { "blocked": "FAIL", "conserved": "PASS", "unobserved": "INCONCLUSIVE", "unsafe": "PASS" } }, { "case_id": "R35", "title": "Declared contract version changed", "group": "Evidence limits", "situation": "The running control contract differs from the version declared for this case.", "available_evidence": "The mismatch is visible before the backup decision. Existing observations no longer establish conformance to the declared contract.", "recommended_decision": "HOLD", "reason": "Results cannot be silently carried across a changed contract.", "verification": "Confirm that the result applies to the declared control contract. A changed contract requires new evidence; INCONCLUSIVE must remain visible.", "limit": "Requalification requires an explicit contract and new evidence. This case does not assess compatibility between real provider versions.", "observed": "Recorded request decisions: 1 HOLD. Payment effects: 0 on A and 0 on B. Overall qualification: INCONCLUSIVE.", "results": { "blocked": "INCONCLUSIVE", "conserved": "INCONCLUSIVE", "unobserved": "INCONCLUSIVE", "unsafe": "INCONCLUSIVE" } }, { "case_id": "R36", "title": "Uncertainty exceeds the operational deadline", "group": "Operational escalation", "situation": "The original attempt is unresolved after a synthetic operational deadline, and the fallback is requested again.", "available_evidence": "An escalation owner and next review are recorded. Evidence that the original cannot pay later has not arrived.", "recommended_decision": "HOLD and escalate", "reason": "Elapsed time creates a review obligation, not new permission to pay.", "verification": "Confirm that the operational deadline led to escalation, without making an unresolved backup eligible for release.", "limit": "This fixture records escalation metadata. It does not measure real response times, staffing or eventual business resolution.", "observed": "Recorded request decisions: 1 HOLD. Payment effects: 0 on A and 0 on B. Overall qualification: PASS.", "results": { "blocked": "PASS", "conserved": "PASS", "unobserved": "INCONCLUSIVE", "unsafe": "FAIL" } } ], "revised_date": "2026-10-03", "revision_note": "Buyer-facing wording revision only. The September 28 source identity and all 64 recorded qualifications are unchanged; no new execution or customer validation is asserted." }