A paid call that timed out could quietly hand its money back to the budget. The wallet-reservation layer released every hold in a finally, but x402 is fire-and-forget: once the signed request has left the machine, an abort or timeout says nothing about whether the gateway settled it. Headroom was over-reported and the next call could see USDC that was already gone (#128, reported by @aurumflux20; parallel fix proposed in #129 by @GentechLabs).
Ambiguous settlements now err tight. If the signed request was dispatched and the call then aborts, times out, or the response body is cut off, the hold is kept for the call's own timeout plus a 30s settlement margin and dropped only by a real on-chain balance read that started after that window. Failures that provably never reached the gateway (budget expired during signing, connection refused, DNS) release normally. A truncated paid 2xx now throws instead of returning ok: true with an empty body. The insufficient-funds message reports what is actually held.
Also: ACKNOWLEDGMENTS.md credits outside contributors and bug reporters (#139).
Tracked separately: the SDK's Solana getBalance() returns 0 on RPC errors, so the fail-open fallback never engages on Solana (#140).
Verified: local suite 683/683; 13 new tests cover the ambiguous / not-ambiguous matrix. Full notes in CHANGELOG.md.
