Implementation commitment completion, 2026-10-03

The frontmatter implementation commitment is completed. This changes its implementation status only. The accepted ADR-0053 design prerequisite is removed from the completed implementation commitment; the separate production deployment and activation criteria below remain open. The original proposal and amendment history below are preserved.

Accepted implementation candidate 07ec0074708bac2dd345156b13eecc72a19f44f9 and source-pinned observer 6f9d49ce implement the scoped protection producer, all-current active enumeration plus exact immutable original lookup, bind-event location provenance, generation and retirement proof, durable compatible-writer completeness clock, and reader/writer guards. These are the named deliverables of commitment 2026-10-02-delivery-adr-0053-coaching-protection-producer-position::0; its text does not require production activation.

Accepted actual isolated PostgreSQL and cross-owner checkpoints establish G0 protected, G1 compensating while Canceled/released and still blocking, and exact G2 retirement with Coaching reopening the original window. Actual writers cannot fabricate, regress, skip or delete the observation clock. Native deferred cancellation/rollback preserves G1 and all snapshotted business facts; the same finalization subsequently commits once and advances the retirement revision. These are runtime producer/consumer proofs, beyond an offline schema model. Financial writeback is separately owned Revenue evidence, not Delivery financial authority or production validation.

The retained candidate manifest at C:/Users/jallr/.codex/worktrees/adr0053-delivery/delivery/docs/evidence/adr0054-delivery/candidate-manifest.json is SHA256 b64944d03b62a131ccee1a947e28725208dd7ab987cd63123dd43ae2e8824e04. It pins accepted archives and actual G0/G1/G2 checkpoints, including coordinator acceptance of native cancellation b8afaa23, unchanged-guard/hook removal f155f6ae, positive G2 5649983c and Coaching ff93e696. The later independent read-only owner check after ADR-0055 replays, retained under the same original isolated database, is post-adr55-owner-readback-proof.json SHA256 dbfaf784772d51fec88f00835b239e032a37d2e51232d7484cc6e949b5911f72, confirming the original capture, one finalization command/audit and unchanged retired revision2/resource snapshot. No old runtime, listener, database or fixture was reset for this completion update.

Production writer/sender drain, additive migration and epoch cutover, runtime roles, actual workload acquisition/issuance, admission pause and protected rollback, owner consumer migration and production resource/Identity/provider evidence remain explicit release gates. All controls remain off unless separately authorized. The ongoing restricted database login preflight and diagnostic TLS preparation establish neither production scheduling activation nor actual Vercel workload acquisition. ADR-0052 2026-10-17T00:42:57Z and ADR-0053 2026-10-17T03:32:35Z deadlines remain unchanged. Root reviews and solely publishes this exact owner-authored source-memo update; no competing indexer/publication was run.

Delivery producer and policy position

Current amended design: after exact Coaching001 review, the normative Coaching protection amendment supersedes this memo's earlier 14-day/window-overlap query, unnamed location read and hash-only bound-retirement projection. The accepted Delivery owner proposal is an all-current active selector plus exact original-obligation lookup, immutable bind-event site ZIP provenance and the real ADR-0052 g-to-g+1 retirement attestation. Use coaching-protection-observation.amended.schema.json and coaching-protection-read.amended-policy.json for assembly; earlier artifacts remain preserved review history. Coaching and Platform must cross-review this exact amended design before formal acknowledgment.

Assignment ADR-0053/delivery/004, coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc/local. Proposed owner-authored scratch memo, root is sole canonical publisher. No runtime, fixture, deployment or mutation permission changes. Source inspected: Delivery b53b08832582dea43fba0832be5eea2a480133d3. Exact Coaching001 memo SHA256 8afb177e56c2734680d5ce3578c0900439b4cab94c7f78b30e1ae937e28509c3 and normative annex SHA256 d98bf0d82c72efb52df7bcf5fc485d140b0e0929f54bb51f20ddc5db98aa8597 have now been reviewed.

Delivery agrees this is a genuine consumer contract gap. Canceled/released is an operational outcome and cannot remove a protected or compensating original booking from Coaching overlap, travel-buffer, free-interval or weekly-preview calculations. Ignoring cancellation forever is also wrong: exact retired g+2 must eventually remove that original protection blocker. Delivery's final admission guard remains necessary but does not make a misleading Coaching projection acceptable.

Existing-read compatibility decision

Do not use the current hold list as negative protection authority. In source, modules/lesson-hold/repo.ts:listLessonHolds filters by lock state and current Lesson start, pages current mutable (updatedAt,id) rows and joins locks/participants through separate reads. Contract section 4.3 explicitly calls it eventually consistent. Canceled/released rows can disappear under its default requested/held/confirmed filter. Its start-based window filter misses protections whose original interval begins before the queried interval. Inspect requires a current lock pointer and cannot enumerate an unknown original blocker. Neither DTO includes original bind generation, protection phase or finalization evidence.

An opt-in versioned extension could be made safe only by replacing these enumeration, snapshot and coverage semantics and introducing explicit Coaching authorization. That is a distinct protection read disguised as an old list. Delivery prefers a narrow new read, preserving every old list/inspect response and permission. A future convenience overlay on those reads can reuse the same producer definitions, but cannot replace this complete coach-window authority.

Exact proposed read

GET /api/v1/delivery/v1/scheduling-protections

Required header Scheduling-Protection-Observation-Version: 1.0. Required and only query fields: organization_id, coach_id, window_start, window_end. All are exact single decoded values. Windows are canonical UTC instants and half-open, start < end, maximum 14 days. This bounds weekly preview plus its travel-buffer halo; callers split longer calendar ranges into covered slices. No cursor, limit, lifecycle, lock-state, participant, Person or financial filter. All other methods return 405. Duplicate/unknown query or protocol/auth headers, invalid UTF-8 and malformed identifiers reject after current workload authentication and before reads. A response is no-store and obtained from the authoritative Delivery database, never a cache, event mirror or replica with unknown lag.

Return one closed Observation1 envelope: protocol_version=1.0, tenant_id=tnt_sguild, exact organization_id, exact coach_id, queried window, observed_at, durable observation_revision, compatible writer_epoch, complete=true, protections array. Maximum 500 records and 262144 UTF-8 response bytes. Enumerate all protected, compensating and retired journal entries whose immutable original coach and interval overlap the query (original.start < query.end && original.end > query.start), independent of current Lesson status, lock state, expiry or reassociation. No silent clipping, truncation, pagination or empty-success fallback. If a bound, lineage/association coherence, generation proof or authoritative snapshot cannot be established, return 503 observation_unavailable with a closed reason. That means unknown coverage, not zero protections. A coherent complete empty response proves only that this covered snapshot contains no protection records.

Each record is a closed union containing exact tenant/Organization, lesson_id, reservation_lock_id, bind_intent_id, original_protection_revision, protection_revision, phase and immutable original booking projection: coach_id, lesson_site_id, lesson_site_config_id, service_area_id, platform_market_id and window. Wire coach_id maps to original booking coach_profile_id, not a new identifier. Do not follow a current mutable Lesson association to change this projection. No Person, payment, financial authority, balance or canonical credit event payload is disclosed. IDs and phase are Delivery-owned operational association facts, not financial permissions.

Protected: protection_revision=g, blocks_original_booking=true, retirement=null. Compensating: protection_revision=g+1, blocks_original_booking=true, retirement=null, even when the Lesson is Canceled and its lock released. Retired compensation: protection_revision=g+2, blocks_original_booking=false, retirement={kind:compensation_finalized, finalization_id, finalization_response_body_sha256, compensation_protection_revision:g+1, retired_protection_revision:g+2, retired_at}. Delivery returns this branch only from its exact immutable finalization journal and correlated compatible continuation, after the approved owner writeback predicates. A generic financial event, missing continuation row, unknown lifecycle or ordinary cancellation cannot manufacture this branch. Original non-compensation retirement is a separate closed branch with kind=bound_settlement and its exact original retirement journal; it must not be mislabeled compensation_finalized. Final generation arithmetic and same-association checks are normative beyond JSON shape.

All records and completeness are one coherent primary snapshot under the compatible Delivery reader/writer barrier. Add a durable Organization-scoped observation clock, advanced transactionally for original protection installation, phase/generation transition, relevant original resource reassociation and genuine staged facts affecting the original obligation. All writers, including old/current reassociation sides and SQL, must participate or be rejected. Since the clock is Organization-wide it covers every queried coach slice without a misleading per-row maximum. Keep epoch compatibility explicit; a larger epoch number alone does not suffice. No remote owner HTTP occurs while holding this local snapshot lock. Unavailable original association yields unknown, never fabricated absence.

Coaching availability semantics and freshness

Protected and compensating original intervals participate in overlap and travel-buffer predicates exactly as the original reserved booking, regardless of canceled display state. Resolve original site/config location through the approved site facts, not a substituted current Lesson site. Query a halo that covers the maximum travel-buffer influence. If the applicable travel bound or original location cannot be resolved, that affected availability result is unknown/unavailable, not eligible. The original site IDs alone are not coordinates or travel authority; Coaching must identify its currently approved location source and its freshness when reviewing this candidate.

A received cancellation event invalidates the local projection and triggers the bounded observation; it cannot remove a blocker by itself. Join event/local records by exact original bind/lesson/lock identity. Accept only monotonically newer observation clocks and phase/generation; do not regress a saved g+1 blocker on a delayed g row. Clear only that exact original blocker on the matching explicit retired proof. Do not clear another bind, a replacement booking or all rows for a Lesson. A complete snapshot's omission does not replace a known journal's retirement proof; a known prior blocker missing from an allegedly covering response remains unknown and requires reconciliation. Retired history must remain enumerable in its original window.

Unknown/outage/overflow/foreign/stale/mixed-snapshot results keep existing blockers and suppress a positive eligible/free result for the uncovered coach interval. They do not assert that all ordinary lessons are protected. This surface is an overlay: existing ordinary booking/availability rules remain and other reservations can still block after original retirement. An empty overlay alone never establishes coach eligibility.

Every by-description eligibility calculation and by-lesson read relying on this overlay obtains a fresh observation per attempt; weekly/calendar display refreshes it per render and on invalidation. A saved observation may support historical display but is not fresh eligibility evidence. A bounded snapshot is not a lease or cross-domain commit fence; a protection may be installed after it. Delivery independently rechecks current protection and coach-slot/resource predicates at actual admission. Longer calendars combine complete slices only with an explicit covered-window map; mixed clocks are historical display, not one coherent affirmative admission result.

Explicit additional proposed authority

Add one exact reviewed service-auth policy: caller project Coaching, subject system:coaching, audience Delivery, singleton tnt_sguild and exact token-bound Organization, sole scope delivery.scheduling.protections.read, method GET, exact path above, closed query as above. Match the configured production Vercel issuer/project/environment pins and current service JWT TTL/skew/jti rules. Validate the current credential and exact Organization reach before records, then filter immutable Delivery-owned original associations by that Organization and exact requested coach_id. Missing scope/org reach is 403; issuance/verification/coherent read outage is 503. No human cookie bridge, wildcard org/project/audience, list of coaches, financial observer scope or reused Sales/Revenue compensation authority. Platform must fill and review its actual deployment pins, not invent them here.

Delivery has coachProfileId associations and CoachingAvailabilitySnapshot, not a canonical Coach model. Neither that snapshot nor a Delivery Lesson pointer proves canonical Coach existence, current eligibility or current Coach Organization membership. This read introduces no Coaching callback, circular eligibility check or additional unapproved scope. Its authoritative source is the exact immutable original Organization-plus-coach association in Delivery's protection journals and their compatible continuation/resource facts. Coaching independently checks its canonical Coach and current eligibility within Coaching before using the overlay.

For any syntactically valid coach_id under an authorized exact Organization, a coherent complete query may return an empty array. Empty means only no matching Delivery protection associations in this covered window. Delivery does not distinguish nonexistent Coach from a Coach with no Delivery protections, and does not return a special foreign-Coach 404 based on data from another Organization. All foreign-Organization rows are excluded without existence/count disclosure. This is scoped-set observation, not canonical Coach lookup. If a historical original association is missing, ambiguous or inconsistent such that Delivery cannot establish whether it belongs to the queried Organization/coach/window, it cannot certify complete absence: return generic observation_unavailable/503 for affected coverage. Uncertain coach/window linkage within the authorized Organization cannot be filtered away as a nonmatch; unresolved Organization ownership must remain quarantined and must not disclose foreign facts. The completeness/migration gate must account for those quarantined records before declaring a covered result complete. No synthesized association, current snapshot or newer mutable pointer repairs that uncertainty by inference.

This is an explicit proposed fifth ADR-0053 read-policy addition, not a silent widening of any accepted ADR-0052 row. Mutation permissions and original four ADR-0052 policies remain unchanged. Amend the assembled four-addition cap and service-auth schema/docs if the affected owners accept this necessary read. Delivery supports scheduling parent 3.0 with this observation sub-spec 1.0; service-auth owner chooses the additive publication incorporating the explicit row. No approval or runtime availability follows from this draft.

Migration commitment and later gates

Upon accepted assembled contracts and explicit Coaching/Platform positions, Delivery commits to implement the scoped observation producer, immutable original-interval enumeration, generation/retirement proof, durable completeness clock and reader/writer guards. The owner-authored conditional commitment and ADR-0053 gate are declared in this memo's frontmatter for root publication. Coaching owns the cancellation adapter, all free-interval/overlap/travel/week-preview integrations, complete-coverage tracking and truthful unknown display. Platform owns exact workload issuance/verifier policy. Do not activate compensation until those consumer migrations are proved together with Delivery's admission/slot guards. Later tests must cover g1 despite Canceled/released, g2 exact retirement, pagination absence by design, interval straddles, foreign reach, overflow, reassociation, clock regressions, missing known records and race/outage behavior. Those runtime proofs are release gates, not a substitute for this missing design contract.

The coordinator's ADR-0050 release findings remain later integration gates: production-capable default-off controls, a distinct admission pause that permits exact authorized recovery, and protected rollback. No ADR-0050 implementation was assigned or performed. Existing listeners/fixtures and ADR-0049 production remain preserved. This memo does not acknowledge the previous pinned ADR-0053 head, which has no such consumer transport. Review Coaching's exact candidate before final assembled design acknowledgment.