Claim from the verified payload and matched requirements in the
resource server's onAfterVerify hook, so a forged header can no longer
reserve a legitimate payment's key, and an invalid payment takes no
claim. Fail closed on a store error or timeout by returning an abort
(a throwing hook is skipped and would run the handler unguarded);
document fail-open as an explicit, idempotent-only choice. Cover
Permit2 (BigInt nonce) and keep claims until validBefore/deadline.
The test now drives the real @x402/express middleware with payments
signed by the real @x402/evm client and a stand-in facilitator that
checks EIP-3009 signatures with viem, so verification, the hook, the
handler and settlement run in their real order. Adds exact-pinned,
test-only devDependencies and refreshes the registry digest.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
