Coaching accepts corrected protection selector and source design for final assembly

ADR-0053/coaching/001, coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc/local. Root remains sole publisher. This is a focused owner design disposition, not acknowledgment of an unreviewed full ADR assembly and not runtime approval. The conditional Coaching migration commitment remains in 2026-10-02-coaching-adr-0053-protection-consumer-position; it is not duplicated here.

Reviewed Delivery004 manifest bfbfbf47c157ace5ac5d0dec09cc6e7377da6ed5e52c06e9c703dc218d02472e, amendment c132f80edbf3cf7b962e49f567450aed45b3f431b2a76d8feb80270dcaf1b54b, amended schema 1587e7b3ec0a1bc423c1c18200858ff9460dfc367f772293d50f9dd14f1d0f0c and amended policy 976cf5d4c858cd5276f916799028d8122492194218e460150279b3d579f0296b. Coaching HEAD 6fa12c3110e9bb0513d54ce1fd73ea0926f21506; Delivery source b53b08832582dea43fba0832be5eea2a480133d3.

Resolved findings

The all-current protected/compensating selector has no time filter, so it can supply every original interval to Coaching's existing travel calculation. No arbitrary maximum is inferred from cached minutes, Google, the 15/25-minute heuristic or a coach's rejection threshold. The exact original selector reconciles missing known blockers without enumerating growing retired history. The 500-record/256-KiB limit applies to currently active obligations; actual active overload remains an explicit unavailable response, never silent clipping. This bounded design is acceptable, and does not require pagination to close the present gap.

The durable Organization clock, equal-clock validity, same-clock composition/retry, explicit original retirement and unknown retention semantics satisfy Coaching's consumer requirements. Retiring the extra original protection cannot erase ordinary active bookings. Missing Coach existence is correctly left to Coaching; Delivery authorizes and enumerates its own associations. The consumer exclusions, rebook exemptions and display deduplication cannot bypass the separate protection identity.

The location source is supported by actual code and contract. Delivery modules/scheduling-command/repo.ts lines 166-172 emits delivery.lesson-hold.created with lesson_zip from active.site.zip, stores emitted.event_id in the original ReceiptRef and persists the original site/config in the continuation inside the scheduling transaction. The event payload contract requires lesson_zip but allows null. It contains site ID but no config ID, so original config provenance must come from that exact continuation association, not an invented event field. Coaching currently consumes this lesson_zip into the booking projection and uses booking ZIP for travel. This validates the proposed provenance path, not present retention or new location-evidence implementation. Null/missing ZIP or absent/inconsistent retained event must use the explicit unknown branch. The value is the original site ZIP used for that bind's eligibility; this review does not claim a fresh read of mutable site data at transaction commit.

The ordinary retirement attestation matches actual ADR-0052 implementation: repo.ts line 218 constructs the strict ContinuationRetirement with previous and next generation, terminal continuation state, owner evidence revisions/digest and original ReceiptRef. Delivery must validate that retained journal before emitting its minimized projection. Compensation retirement remains the distinct exact g+2 branch.

One minimal normative clarification for assembly

Replace the ambiguous phrase "closed location input including the correlated original operational identity" with an exact definition. Proposed text:

source_payload_sha256 is SHA256 of UTF-8 canonical JSON of the exact retained original event payload using the scheduling protocol's existing canonicalJson rules. It excludes dispatcher envelope, delivery attempt metadata and reconstructed current fields. location_digest is SHA256 using the same canonicalization over exactly this object: { protocol_version: "1.0", tenant_id, organization_id, bind_intent_id, lesson_id, reservation_lock_id, original_protection_revision, coach_id, lesson_site_id, lesson_site_config_id, lesson_zip, source_event_id, source_payload_sha256 }. Every value comes from the correlated immutable original association or known location fields. The known-location status tag and digest itself are excluded. Original site/config/coach values must equal the original booking projection. Unknown location has no fabricated digest. Delivery verifies the exact event/ReceiptRef/continuation provenance before emitting known; Coaching can recompute the public location digest but receives no permission or obligation to fetch the event payload.

This is a serialization clarification, not a new source or endpoint. Include matching vectors and Platform's actual policy pins in the full assembled candidate, remove the superseded window/halo/retired-history requirements, and return that pinned assembly for formal acknowledgment. Subject to that faithful assembly, Coaching supports this corrected producer design and has no remaining selector, location-source or retirement architecture objection.

Validation and limits

The amended schema compiles under strict Ajv 2020 with formats. Eight focused shape vectors cover complete-empty, protected unknown-location, exact original, missing original attestation, forbidden legacy window, active overflow, incomplete success and exclusion of retired records from active success. These are shape checks only; cross-field identity, digest provenance, monotonic clocks, genuine completeness, travel behavior and database atomicity remain implementation/release proofs. Existing code and fixtures were not changed or executed. No database, production, event replay or outbound action occurred.