Revenue records bounded consume inbox refund and correction writer evidence
Runtime source is 915ee657d4d5c6c205a26c180a978a26d9864f41. This checkpoint adds 13 fresh local cases to the historical six and the separate generic-release defect/fix record. No runtime source changed during these additional cases. Exact evidence and harnesses records 18 source hashes verified against that commit, actual PostgreSQL lock waiters, requests, receipts, ledger/outbox rows, correction retries and inbox dedup state.
Results and limits
| Case | Actual result |
|---|---|
| Consume first | Actual runLessonConsumePg consumes a past-start RESERVED lesson, creates one lesson debit/event; guarded release blocks. Retry is noop. |
| Closure first, direct consume | Actual optimistic consume update is noop, no debit/consumed event, lesson stays Scheduled and receipt stays clear. A subsequent direct retry rejects the terminal reservation. |
| Inbox consumption first | Actual lesson.delivered handler consumes and records dedup; same-event retry returns already_processed. Guarded release blocks. |
| Closure first, concurrent inbox | Handler marks Revenue's mirror Completed; its queued consumption is noop, handler records dedup and returns first_time. Duplicate returns already_processed. Reservation stays RELEASED with zero ledger and immutable receipt; current assessment becomes reconciliation_required(consumed). This is not a clear closure result. |
| Fully delayed inbox after closure | Both attempts reject consumption. No dedup row is written, but mirror Completed persists. Reservation, release receipt and outbox remain unchanged with zero ledger; assessment is reconciliation_required(consumed). This differs from concurrent inbox completion. |
| Forfeit, both serialization orders | Actual lock entrypoint establishes LOCKED/debit first. Guarded unpaid release is ineligible; actual forfeit succeeds, retries add no ledger/event. No claim of two eligible successful winners. |
| Refunding and refunded, both orders | Actual funding/refund-state entrypoints establish valid prerequisites. Guarded release blocks on funding_present; actual refund-state transitions complete and retry without additional events. No external refund-provider proof. |
| Outcome correction first | Actual consumed source and preview/apply produce one adjustment; guarded release remains blocked. Same correction replay is stable. |
| Blocked closure before correction | Actual correction transaction loses serialization and rolls back with mapped conflict. Fresh preview with the same correction ID/request allows one adjustment; duplicate is stable. Reservation remains CONSUMED. |
Each reachable concurrency case paused an actual transaction callback before commit and observed the competing backend in pg_locks. The fully delayed case is explicitly sequential. Direct service entrypoints do not prove signed HTTP inbox authentication. Disposable consume fixtures have no purchase-credit sources, so best-effort recognition logs report insufficient attribution; no recognition readiness is claimed.
The initial remaining-writer r1/r2 fixtures retained expected revision zero after prerequisite funding/locking/consumption. They are preserved but superseded by fresh r3 cases using the actual current revision at admission. An earlier correction harness wrongly asserted that both calls must succeed; its failed assertion and complete evidence remain preserved. The new case treats the mapped conflict as a real losing transaction and demonstrates supported re-preview and exact-key dedup, rather than altering the writer or suppressing an error.
Acceptance matrix update
Section 9 payment/cancel, funding/lock/release and consume/release ordering now have bounded actual-entrypoint lock evidence. Generic release is corrected and tested in both orders. Forfeit/refund/correction add valid-precondition blocked-closure and recovery evidence, not policy exceptions. Inbox delayed/reordered handling remains partial because it records a contradiction, and the fully delayed failure has no dedup completion. This checkpoint proves non-resurrection and no duplicate financial effect in its named cases, not a complete all-writer inventory.
Still open: account-funded allocation races, other synchronous/inbox/recovery entrypoints, external provider partial/refund/admitted-charge timing, further process-crash boundaries, deployed auth and environment controls, throughput, migration compatibility and cross-domain activation. ADR-0050 remains proposed and unimplemented. The generic-release fix's 612-test full regression, typecheck and smoke evidence is in the prior proof; no code changed here to justify repeating that suite.
All worker processes exited. No HTTP server was started for this checkpoint. The private PostgreSQL database, all previous fixtures and failed evidence remain intact, as does the native PostgreSQL service. Nothing was pushed or deployed and no production gate is cleared.
Evidence documentation is committed locally at 3359395b33e982b3f8b23f6cfdb4ce70a4c92362; runtime remains 915ee657d4d5c6c205a26c180a978a26d9864f41. The broader Revenue ADR-0048 commitment remains working.