Coaching default-off protection migration implemented with isolated persistence evidence
Assignment ADR-0053/coaching/003, coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc/local. Checkout C:/Users/jallr/.codex/worktrees/adr0053-coaching-protection/coaching, branch codex/adr0053-coaching-protection. The accompanying evidence manifest pins the commit and file hashes. Root alone publishes and indexes this owner memo.
The new Scheduling Protection module validates the accepted closed response schema, exact original identity, monotonic Organization clock, compatible configured epoch, generation branches, immutable site/config/location digest and retirement attestation. It saves independent obligations in a Coaching-owned additive table using Organization advisory serialization and row-generation CAS. Verified events invalidate observations without retiring them. Missing events do not prevent fresh all-active discovery. Missing known originals require exact-original lookup at the same clock. Unknown or expired authority retains blockers and suppresses affirmative availability.
The coordinator's lock-delay finding is addressed by passing the monotonic deadline into persistence, limiting transaction acquisition/execution and SQL lock/statement timeouts to the remaining budget, and checking expiry after lock acquisition and immediately before/after the write, before commit. The independent two-session database test holds the exact Organization advisory lock past the remaining budget and proves that the attempted g2 retirement does not replace the stored g1 blocker. The October 3 deferred-constraint review found no deferred constraint in Coaching's additive migration, but save now explicitly drains SET CONSTRAINTS ALL IMMEDIATE under a refreshed remaining statement timeout and checks the deadline again. An actual PostgreSQL deferred constraint trigger sleeping 800 ms against a 250 ms budget proves rollback preserves records, revision and generation. This does not claim a hard upper bound on COMMIT WAL flush or network acknowledgement.
The workload adapter exchanges a fresh audience-bound Vercel proof and scoped Platform bearer for every HTTP read. SDK audience exchange caching is bypassed with skipCache and a fresh UUID jti. No cookie, static bearer, alternate production host, financial scope or token/proof cache is used. No-store, redirect denial, strict UTF-8 byte limits and deadline checks apply. Actual isolated audited Platform issuance and Delivery GET composition is now proven at Coaching commit 0587f106520cd60671e7eaf4be148049787f829d, distinct from earlier adapter doubles.
Eligibility by description and Lesson, free intervals, operator supply and weekly preview integrate the separate protection dimension. Ordinary Lesson exclusion, rebook ownership and Person/type/window display deduplication cannot erase it. All active originals feed protection travel regardless of date, without changing ordinary travel thresholds or estimator rules. Weekly protection travel spans midnight. Normal booked occupancy remains after extra-protection retirement. Unavailable coverage is exposed through protection_unavailable and protection_status; coach-availability v2 explicitly requires consumers to treat unknown why values as opaque ineligibility. The old ordinary booking state and ownership remain intact.
Verification boundaries
The evidence manifest records final command counts and exact source. Unit/adapter tests cover generation and retirement branches, equal/lower/mixed clocks, duplicates, source loss, overflow, deadline, fresh issuance and negative scope/reach. The isolated database tests execute actual Coaching Prisma persistence, eligibility and the by-description route, while explicitly doubling the Delivery observation transport. The real signed inbox route is served over loopback HTTP with a fresh fixture secret and isolated Coach: subscriber smoke proves initial/replay 200 and bad-signature 401 plus two durable invalidations. No shared mesh, prior ADR-0046/0048 fixture, production database, external fanout or outbound action was used.
Integration and release gates
The existing migration commitment is working, not complete. Actual composition used Platform 368e5b526c71b6e6f18124ec4026747a83d503d1 on 57783 and Delivery 215da101ac58f5bb9d9b5def39cf1e80c977a3b1 GET-only listener 55337. All 714 Platform and 856 Delivery source hashes were verified before HTTP, plus Delivery launcher SHA f2f406833539ce9c977364ed171869cf8b1258fb98d64340c4bfc20a6f2d9513. Five fresh issued claims passed canonical issuer, Coaching subject, Delivery audience, fixed organization, scope and 300-second TTL checks. Independent read-only Platform database inspection found exactly one auth.service_token.issued audit row per requestId/jti. No tokens or private material were persisted.
Four composition tests passed in fresh database coaching_adr0053_c1249d2e5fae4d6a9e174c39bdbf146c. Known-only coach persisted epoch 3/revision 3048/generation 2; equal-clock reread passed; unknown location prevented positive availability; 501 active overflow remained unavailable without persisting an authoritative empty set; seeded exact-original retirement validated. Evidence .tmp/adr0053-proof/audited-composition.json SHA 03506682bec2f688aff763fe8b5642434b13f2dc3e38d5b414fb8e356bdb4311; audit evidence .tmp/adr0053-handoff/platform-composition-audits.json SHA 99a958eab80dcb23c96e19806057a893bed12fd09a2ed511ec1767e0a588de70. Limits remain synthetic Vercel proof, seeded lifecycle, bootstrap connection with startup SET ROLE rather than separate restricted runtime login, and permitted GET admission bookkeeping. Actual bind/compensation/finalization business mutation, production and ADR-0054 authority are not proven or activated.
The deadline follow-up passed seven isolated persistence tests in new database coaching_adr0053_f0c976ba34314c3988475e845c4211be. Unit suite passed 146 with 12 gated skips, and typecheck passed. These tests exercise the new deferred drain; the composition above remains pinned to its prior exact source.
Exact additive migration SHA 704f4a2cf9dcf6b666035727fa6c95a39620557f7affc779f2867542e769521d passed transactional DDL rollback, committed apply, unchanged sentinel data, and rollback preserving an existing observation in fresh database coaching_adr0053_dc3fa16c1e484207983d9998fec3e465. Catalog confirms only a nondeferrable primary key. Evidence .tmp/adr0053-handoff/migration-rollback.json is an isolated SQL proof, not production Prisma migration deployment or permission to remove a live protection table.
Read-only Vercel inspection found production deployment dpl_7oinq9vMFUm28MqWZTtKjZAwjoyh READY. Current production project environment listing has neither COACHING_SCHEDULING_PROTECTION_ENABLED nor COACHING_PROTECTION_WRITER_EPOCH. Clean-directory env export yielded no usable DATABASE_URL despite an encrypted variable being listed; no production database connection was made. Exact serving-process role, grants, schema and compatible producer epoch therefore remain unverified, not inferred from local credentials or current project settings. Evidence .tmp/adr0053-handoff/production-readiness.json records this limit. Runtime performance, full lifecycle and coordinated deployment remain shared gates.
COACHING_SCHEDULING_PROTECTION_ENABLED remains default-off. The exact COACHING_PROTECTION_WRITER_EPOCH is mandatory when enabled. Apply the additive migration before cutover. After shared compensation activation, independently disabling the consumer or deleting its observations is unsafe; root must pause new scheduling admissions and retain compatible observation/recovery during any rollback. The module README inventories all affected entry paths and table writers and records rollback constraints.
Requested source commitment state for root publication: keep commitment 0 of 2026-10-02-coaching-adr-0053-protection-consumer-position working, preserve its description/priority/size, and record the cleared isolated auth/GET composition dependency separately from remaining full lifecycle and production gates. No duplicate commitment is declared. The module README now provides the source-backed HTTP, operator, event and table-writer inventory. Root remains the only publisher/indexer for this reviewed artifact.
October 3 actual third-original lifecycle checkpoint
This later evidence supersedes the seeded-lifecycle limitation for this exact local original only. The prior seeded proof and its source pins remain historical evidence. Actual consumer source is 8dfd8a37208579f8f7bcc7612e21d4f63cc89a5d, unchanged observer source 6f9d49ce1c6e9545b7b47dd309414f206b54a2da, and audited issuer source ad20c705895bd48786e6fc0e14939050a5013b1f. Delivery reports actual compensation/finalization writer 07ec0074708bac2dd345156b13eecc72a19f44f9; that owner writer is distinct from the observer source. All observations use Delivery database adr0053_delivery_78754545330140fc8652ba889b5ed33a, existing 50251 observer, 50387 issuer, and Coaching 63335 listener and database coaching_adr0053_8ff279d395d6418c8f94b0f351d15d8c. No protection rows were seeded and Coaching performed no Delivery or Revenue business writes.
The exact original is lesson les_01a1004d-7cbd-71a4-b592-13557ca1813f, intent 29be0505-de11-4891-8fe2-d51bd0fd0f63, lock lock_01a10061-1424-70db-90a1-0fcb4f8a9839, coach coa_01a1002e-f462-7e21-8fe0-297f43a9dc89, October 10 16:00 to 16:30 UTC, canonical market and area suffix 0054, known ZIP 75024.
| Checkpoint | Delivery observation | Coaching durable state | Eligibility | Immutable evidence SHA256 |
|---|---|---|---|---|
| Actual bind g0 | Epoch 3, clock 72, protected revision 0, blocks true | Clock 72, generation 8 | already_booked | 9ec3fd95525bf5598da6b0e85072547fa9e8ef082b4161eb99c2318a8dbbef5b |
| Actual compensation g1 | Epoch 3, clock 81, compensating revision 1, blocks true | Clock 81, generation 9 | already_booked | 262526bbdd81c7dc188196149626d6af63411875b8282a86ad1ff605becfbf09 |
| Actual finalization g2 | Epoch 3, clock 86, complete active empty plus exact-original retired revision 2 at the same clock | Clock 86, generation 10, full retired record retained | fits | ff93e6964d0bb59a8f3a2178d165224a3310784215db8fb781dedc99574828a0 |
Artifacts are .tmp/adr0053-eligibility/third-bound-checkpoint.json, third-compensating-checkpoint.json, and third-finalized-checkpoint.json under the Coaching worktree. Each contains actual HTTP, fresh issuance claims, matching audit identities, and persisted consumer facts. Audit reads used read-only Platform transactions: one matching issuance audit at g0, one at g1, and two independent matching audits for g2 active and exact-original reads. No token/private material is retained. Original booking, site/config identity, known ZIP and location digest remain immutable across all three checkpoints.
The g2 retirement attests compensation_finalized, finalization 5eb2fd15-a206-4143-88dd-0a2c888498e3, response SHA 5d79d9cab8118b9a358e3e616497eb6223c6e24ec4dc09c9e09c779bb5aeaea5, compensation revision 1, retired revision 2, retired at 2026-10-03T06:43:02.255Z. Coaching did not infer retirement from the empty active result; it fetched and validated the exact original at the same clock before saving and reopening the interval.
This closes the consumer's actual local lifecycle-observation gap for this tuple. Delivery and Revenue independently own business transaction, deferred rollback and financial assertions. Synthetic workload proof and test-only origin/module remapping remain; no production or ordinary-booking projection coverage is claimed. Exact production serving-role/schema/epoch, broader release acceptance and activation remain open. Root should retain the overall commitment as working until those agreed owner gates are resolved, and publish this reviewed memo without rewriting historical checkpoint artifacts.