Revenue proves initial writer races and fixes duplicate generic release after guarded closure
Revenue found and fixed a real stale-decision defect in the generic release writer. A generic release that read RESERVED before guarded closure committed could wait behind the shared lock, then emit a second credit.released event and overwrite terminal resolution metadata. It did not resurrect the reservation or create a debit, but it advanced revision again and violated completed-outcome protection.
The fix is local commit 915ee657d4d5c6c205a26c180a978a26d9864f41 on codex/guarded-handoff-integration, following d404d2c0ae5f2ac80b6a7276aa14f6bb3e9d5072. runReservationReleasePg now acquires the existing shared financial lock before all reservation/ledger reads, validation and effects. A losing generic release reads the committed RELEASED state and returns noop without rewriting metadata, creating a reversal or emitting an event. Policy and event schemas are unchanged. This source is not pushed or deployed; d404d2c remains the historical baseline and is not the corrected release pin.
Bounded actual writer evidence
The exact evidence includes six baseline cases and the valid generic-release failure/fixed cases, exact receipts/outbox IDs, row state, ledger and independent pg_locks observations. All run on fresh cases in private database adr0048_writers_3144606a55c14309a929ad566003fc4e, schema revenue_writer_test, with independent 50-model Prisma client and actual 48+49 migrations providing 7 closure row guards, 14 closure serializers, 21 assessment serializers and 21 revision triggers. No shared-mesh or historical fixture reset occurred.
| Actual writer ordering | Observed result |
|---|---|
| Funding before guarded release | RESERVED/FUNDED; guarded release blocked, no release receipt/event |
| Guarded release before funding | RELEASED revision 1/PENDING_FUNDING; queued funding rejects, zero ledger |
| Lock before guarded release | LOCKED and one actual lock debit with lock/first-handoff events; guarded release blocked |
| Guarded release before lock | RELEASED revision 1/PENDING_FUNDING; queued lock rejects, zero ledger |
| Payment before cancellation | PAID 1000; cancellation blocked without receipt |
| Cancellation before payment | Original cancellation receipt remains completed; truthful PAID 1000 is recorded and current assessment becomes reconciliation_required |
| Generic release before guarded release | Generic release succeeds; guarded closure blocks on unproven prior-terminal provenance |
| Guarded release before generic release, baseline | Generic writer incorrectly reports success and adds a second release event, revision 2 |
| Guarded release before generic release, fixed | Generic writer returns noop; one release event, revision 1, original closure notes preserved, zero ledger |
These are actual exported writer entrypoints and dispatcher SDK transactions, not direct SQL state mutations used as writer substitutes. The test barrier pauses the intended transaction after its real callback and before commit. A separate connection records the competing backend waiting on that transaction's advisory lock; timing alone is not treated as evidence. Harness transaction timeout is 30 seconds. Provider invoice setup uses an intercepting local fake only, with no external Square request.
Git archive produced CRLF source while git blobs use LF. The artifact records both raw hashes and verifies LF-normalized equality for the historical sources. Fixed cases add the separately identified generic-release delta. The first six artifacts remain immutable.
Preserved setup and failed evidence
The first allocation attempt used an obsolete Prisma CLI flag and stopped before schema writes. An independent check proved zero user tables before resuming that exact empty database without a reset. A first race then completed but JSON serialization rejected Prisma BigInt; its rows/readback were retained and excluded from the accepted six fresh cases. The initial generic-release ext1 harness used internal administrative_void, outside the public input enum. It is preserved but excluded from policy-valid evidence. Fresh ext2 uses valid Policy Release and reproduces the same defect; fresh fixed1 verifies both corrected orders. No failed case was silently repurposed.
Verification and remaining gates
Fresh separate regression database revenue_release_fix_1aa1e3dedfa34bd39923ecc9f8562da4, schema revenue_test, received the actual 48+49 migrations. Focused checks passed 54/54; full regression passed 612 tests across 77 files. Typecheck, eight-event-family dispatcher smoke and diff checks passed. The final ledger audit scanned one test entry and found zero append-only violations. This bounded scan is not production financial validation.
Remaining consume, forfeit, refund, correction, inbox/recovery, provider timing and additional crash-boundary coverage remains partial. Valid forfeit requires LOCKED and refund transitions require funded state, making guarded unpaid release ineligible; future proof must distinguish those policy rejections from two valid winning admissions. No completion of the broader writer matrix is claimed here. Schema-wide lock throughput, deployed authentication, production migration compatibility, tenant/queued-event cutover and cross-domain activation gates remain open. ADR-0050 lineage is proposed and unimplemented. The broader Revenue ADR-0048 commitment stays working.