1. SESSION CREATION (unchanged)
   User signs ERC-3009 (one-time)
   Facilitator creates session, returns sessionToken

2. SESSION USAGE (unchanged UX)
   Client sends session token per request
   Facilitator returns CUMULATIVE receipt:
     { sessionId, nonce, cumulativeAmount, timestamp, facilitatorSig }
   Client stores only latest receipt (can re-fetch if needed)

3. FACILITATOR COMMITS CAPTURE
   Builds merkle tree of ALL issued receipts
   Publishes: (merkleRoot, captureAmount) for sessionId
   Stakes collateral (10% of capture value)
   CRITICAL: Cannot forge receipts after commitment

4. CHALLENGE WINDOW (3-7 days)
   User disputes if captureAmount > their latest receipt's cumulative
   Provides their highest-nonce receipt as proof
   Facilitator can counter with higher-nonce receipt if user is lying
   BUT: Facilitator must prove receipt exists in committed merkle tree
   Contract compares nonces: highest nonce wins (if merkle proof valid)

5. SETTLEMENT
   After window: funds released to receiver
   Collateral returned to facilitator

interface CumulativeReceipt {
  sessionId: bytes32;          // Links to on-chain escrow (and original ERC-3009)
  nonce: uint256;              // Monotonically increasing per session
  cumulativeAmount: uint256;   // TOTAL spent so far (not just this request)
  timestamp: uint256;          // Unix timestamp
  facilitatorSignature: bytes; // EIP-712 signature over all above fields
}

Request 1:  { nonce: 1,   cumulativeAmount: $0.05 }
Request 2:  { nonce: 2,   cumulativeAmount: $0.10 }
Request 3:  { nonce: 3,   cumulativeAmount: $0.15 }
...
Request 100: { nonce: 100, cumulativeAmount: $5.00 }

GET /api/receipts/:sessionId/:nonce
Authorization: Bearer <sessionToken>

Response: { receipt: CumulativeReceipt }

interface ITrustlessEscrow {
  // Facilitator commits capture with merkle root of all receipts
  function commitCapture(
    bytes32 sessionId,
    bytes32 merkleRoot,      // Root of all issued receipts
    uint256 captureAmount
  ) external payable; // msg.value = collateral stake (10% of captureAmount)

  // User disputes: "My receipt shows less than you captured"
  function disputeOverCapture(
    bytes32 sessionId,
    CumulativeReceipt calldata userReceipt  // User's highest nonce receipt
  ) external;
  // Contract verifies:
  // 1. facilitatorSignature is valid
  // 2. userReceipt.cumulativeAmount < captureAmount
  // If both true → dispute opened, facilitator must counter

  // Facilitator counters with higher nonce receipt + merkle proof
  function counterDispute(
    bytes32 sessionId,
    CumulativeReceipt calldata facilitatorReceipt,
    bytes32[] calldata merkleProof  // Proves receipt was in committed tree
  ) external;
  // Contract verifies:
  // 1. facilitatorSignature is valid
  // 2. Receipt exists in committed merkle tree (prevents forgery!)
  // 3. facilitatorReceipt.nonce > userReceipt.nonce
  // If all true → dispute rejected (user was lying)

  // After challenge window with no successful counter
  function resolveDispute(bytes32 sessionId) external;
  // Slashes facilitator, refunds user the difference

  // After challenge window with no disputes
  function finalize(bytes32 sessionId) external;
  // Releases funds to receiver, returns collateral
}

struct CumulativeReceipt {
  bytes32 sessionId;
  uint256 nonce;
  uint256 cumulativeAmount;
  uint256 timestamp;
  bytes facilitatorSignature;  // EIP-712 over (sessionId, nonce, cumulativeAmount, timestamp)
}

function verifyReceipt(CumulativeReceipt calldata receipt) internal view returns (bool) {
  bytes32 structHash = keccak256(abi.encode(
    RECEIPT_TYPEHASH,
    receipt.sessionId,
    receipt.nonce,
    receipt.cumulativeAmount,
    receipt.timestamp
  ));
  bytes32 digest = _hashTypedDataV4(structHash);
  address signer = ECDSA.recover(digest, receipt.facilitatorSignature);
  return signer == facilitatorAddress;
}