Coaching supports the dedicated protection observation with explicit remaining design requirements
Assignment ADR-0053/coaching/001, coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc/local. Owner-authored scratch candidate for coordinator publication only. Coaching source HEAD 6fa12c3110e9bb0513d54ce1fd73ea0926f21506. Review target PR4 af45908fc13ce698097e6ff6dbde66bbdb37bc4b and Delivery004 observation proposal, schema SHA256 360c0f8898c7ac206e0f71e28a518ea046a5469c6bc8564aef35c3c7fb4a1978. No acknowledgment of the assembled ADR yet. No runtime, database, fixture, deployment or canonical-publication changes.
Decision
Use Delivery004's dedicated GET /api/v1/delivery/v1/scheduling-protections and proposed sole scope delivery.scheduling.protections.read. Preserve the existing eventually consistent hold list and inspect interfaces. Coaching supports the 14-day query limit, 500-record/262144-byte complete snapshot limit, no pagination or truncation, exact original overlap selection, Organization observation clock and explicit immutable retirement proof. Overflow is unavailable, not an empty success. This is the minimum coherent transport, subject to the concrete amendments below and Platform's exact policy pins.
Current cancellation marks the booking released. The eligibility, free-interval and travel paths only block reserved or locked bookings, and weekly preview filters released rows. A cancellation event therefore cannot be the protection authority. Delivery's final admission guards are necessary but do not repair affirmative availability already returned by Coaching.
Concrete remaining amendments
Original location must be included in the producer-owned snapshot. Coaching currently reads booking ZIP, not historical site/config facts, for travel. Delivery004 carries site/config IDs but no ZIP and references an unnamed approved location read. Add an immutable original location object carrying the exact bind-time site/config association, ZIP and source revision or digest. If Delivery cannot provide that fact, identify and approve an exact historical read and its authorization before acceptance. Do not introduce a hidden site-read scope or substitute current site data. Coaching's existing local booking ZIP is not completeness evidence for a newly discovered protection.
Travel coverage is not yet closed. The current estimator reads cached ZIP-pair minutes without an age check, otherwise calls Google Maps, then uses a tagged 15/25-minute heuristic. There is no proven global maximum. maxInterLessonTravelMinutes is an eligibility rejection threshold, not a bound on computed before/after buffers. The instruction to query a maximum travel halo therefore lacks an executable value or derivation. Do not claim that a 14-day query cap supplies that bound. Before acceptance, choose and version either a finite influence policy enforced for all records and estimate sources, with an explicit horizon and out-of-bound behavior, or an observation selector that returns all travel-influencing original protections. Define boundary-straddling and midnight behavior. Until coverage and original location are known, only the affected coach/window is unavailable. This is a design dependency, not a demand for runtime implementation before design approval.
Delivery must not validate canonical Coach existence through a circular Coaching callback. Authenticate exact tenant and token-bound Organization; validate syntax and enumerate Delivery-owned original associations scoped to that Organization and coach key. A complete empty set means no Delivery protection overlaps in that covered snapshot, not that the Coach exists, is active or is eligible. Coaching separately validates its own current Coach row, Organization, status, capacity and credentials. Identical empty behavior must not disclose a matching Coach in another Organization. Unrecoverable association lineage for a potentially relevant protection yields unavailable, not omission. Remove the promised missing/foreign Coach 404 unless a separately approved authoritative mechanism actually supports it.
Bind the two retirement branches explicitly to existing authority. Compensation retirement is exactly g+2 after the matching immutable finalization, with g+1 compensation history. Ordinary bound settlement is g+1 only through the existing ContinuationRetirement CAS and terminal settled/abandoned evidence described in scheduling-workload-and-bind-settlement section 4 and scheduling-v2-compatibility-and-release. Hash-shaped strings alone are not proofs. Delivery must authenticate and correlate that journal before emitting the branch; Coaching trusts this authenticated Delivery attestation and never fetches Revenue evidence. A settled ordinary continuation removes only the extra original protection overlay, not the ordinary reserved/locked booking or its travel occupancy.
Consumer obligations on acceptance
Apply the appended candidate normative text to the assembled contract. Coaching will use a separate protection dimension keyed by exact tenant/Organization, bind intent, Lesson, lock and original generation. Do not coerce compensation into a permanent reserved state or key retirement only by Lesson. Keep operational Canceled display truthful while showing its retained availability constraint.
By-description, by-lesson, operator free intervals, travel buffers and weekly/calendar preview must all use the overlay. excludeLessonId and Person/participant-owned rebook exemptions must not discard protected or compensating obligations. Weekly preview's semantic deduplication by Person/type/window must not merge independent protection identities. Identity rekeys can update presentation without changing original obligation identity or retirement scope.
Acceptance vectors must cover g+1 after cancellation, lost and delayed events, fresh discovery with no local booking, both exact retirement branches, a remaining ordinary booking after retirement, replacement bind on the same Lesson/window, foreign Organization, complete-empty, missing known blocker, duplicates and conflicting generations, overflow, location changes, boundary-straddling travel, unavailable authority, and the observation-to-admission race. Fresh reads eventually release a finalized original blocker; cancellation suppression forever is not completion.
Source evidence
- modules/dispatcher-inbox/service.ts and modules/availability/bookings-repo.ts: cancellation and credit release paths update projection state without a distinct protection dimension.
- modules/availability/service.ts: effectiveBookings excludes by Lesson or owned rebook, overlap and free-interval subtraction require reserved/locked, and travel buffers consume booking.zip.
- modules/travel-time/service.ts and repo.ts: ZIP cache/Google/heuristic chain, no finite maximum or cache-age admission check.
- modules/operator-console/weekly-preview.ts: released filter and Person/type/window semantic duplicate collapse.
- modules/operator-app/repo.ts and modules/operator-console/repo.ts: current hold-list clients cap pagination without establishing authoritative complete protection coverage.
The coordinator alone publishes and indexes the assembled owner artifacts. This conditional implementation commitment does not activate compensation or authorize a runtime change during this design review.