id	kind	claim	recorded_value	expected	http	ms	recorded_at
C01	control	Pay office-supplies.example (allowed) -> An ordinary merchant inside the limits.	"APPROVED"	["APPROVED"]	200	424	2026-11-03T22:48:22+00:00
C02	attack	Pay casino.example (blocked) -> On the deny list.	"DECLINED"	["DECLINED"]	200	162	2026-11-03T22:48:23+00:00
C03	attack	Same casino, in capitals with a trailing dot -> Spelling tricks don't get past the list.	"DECLINED"	["DECLINED"]	200	163	2026-11-03T22:48:24+00:00
C04	attack	Same casino, as a checkout web address -> A full address still resolves to the blocked merchant.	"DECLINED"	["DECLINED"]	200	177	2026-11-03T22:48:24+00:00
C05	attack	A sub-domain of the casino -> Sub-domains of a blocked merchant are blocked too.	"DECLINED"	["DECLINED"]	200	140	2026-11-03T22:48:25+00:00