Ambiguous-settlement handling is correct — retry-safety conformance attestation

Not a bug report — the opposite.

I've read a lot of x402 facilitator code (50+ implementations, documented), and `FacilitatorClient` here handles the case most get wrong: a `200` with `{success:false}` is treated as an evaluated verdict, and only a genuine transport/protocol failure raises `FacilitatorError` — so a lost response after `/v2/settle` is surfaced as "could-not-determine", never fabricated into a `SettleResponse`. That boundary (evaluated-invalid vs. could-not-determine) is exactly what the settlement-status vocabulary I've been contributing upstream (x402 spec PR #3325) exists to name. You got it right, and most don't.

Because you got it right, you're the kind of implementation that benefits from being able to *show* it. We maintain a conformance battery — a hostile client that fires the retry / concurrency / ambiguous-settlement cases at a facilitator — and issue a signed third-party "Retry-Safe Verified" attestation. For a Canton facilitator selling into enterprise, that's trust collateral a customer can independently check.

If that's useful I'm glad to share what the attestation covers and how it runs. Either way — genuinely nice work on the settlement handling.

The issue names FacilitatorClient and the /v2/settle endpoint, but provides no repository file, test, implementation request, or acceptance criteria. Before starting, ask the author to define whether this is an attestation feature and specify the expected changes and verification; as written, there is no actionable definition of done.

Written by the indexing model from the issue text.