---
title: "Purchase state model"
description: "The redacted facts and state transitions in the preview purchase ledger."
---

> Documentation Index
> Fetch the complete documentation index at: https://help.tooluse.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Purchase state model

<p>A purchase records intent, checkout approval, wallet approval reference, one payment attempt, reconciliation, and merchant-order confirmation as separate facts. A wallet approval is not proof of payment, and payment is not proof that the merchant created an order.</p>
<h2 id="states">States</h2>
<table>
<thead>
<tr>
<th>Phase</th>
<th>States</th>
</tr>
</thead>
<tbody>
<tr>
<td>Research and login</td>
<td><code>CREATED</code>, <code>RESEARCHING</code>, <code>LOGIN_REQUIRED</code></td>
</tr>
<tr>
<td>Checkout and consent</td>
<td><code>CHECKOUT_READY</code>, <code>HUMAN_CONFIRMATION_REQUIRED</code></td>
</tr>
<tr>
<td>Wallet</td>
<td><code>WALLET_APPROVAL_REQUIRED</code>, <code>WALLET_APPROVED</code>, <code>PAYMENT_MATERIAL_READY</code></td>
</tr>
<tr>
<td>Commit and verification</td>
<td><code>COMMITTING</code>, <code>RECONCILING</code>, <code>PAID</code>, <code>ORDER_CONFIRMED</code></td>
</tr>
<tr>
<td>Terminal or exceptional</td>
<td><code>CANCELLED</code>, <code>FAILED</code>, <code>OUTCOME_UNKNOWN</code></td>
</tr>
</tbody>
</table>
<p>Every public response includes a redacted purchase projection and a revision. A write based on stale state is refused rather than silently overriding a newer decision.</p>
<h2 id="commit-boundary">Commit boundary</h2>
<p>Before <code>COMMITTING</code>, a purchase can be cancelled and a human may claim the browser handoff. After the commit boundary, cancellation becomes reconciliation of the original attempt; the system must not create a second payment attempt automatically.</p>
<h2 id="boundaries">Boundaries</h2>
<ul>
<li>The current intent schema accepts <code>USD</code> and a positive <code>maxTotalUsdMicros</code>.</li>
<li>One database constraint permits at most one payment attempt per purchase.</li>
<li>A shipping address reaches the ledger only by opaque reference.</li>
<li>Payment and merchant-order execution are not exposed as public executor routes.</li>
</ul>
<h2 id="see-also">See also</h2>
<ul>
<li><a href="/agentic-purchases/checkout-approval">Approve a checkout</a></li>
<li><a href="/agentic-purchases/availability">Availability and boundaries</a></li>
</ul>

Source: https://help.tooluse.net/agentic-purchases/state-model/index.mdx