Delivery compensation package review

Assignment ADR-0053/delivery/002, coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc/local, participant 01a0ff07-cd25-7490-9008-a734cad7147e. This is a proposed owner memo for root publication. It contains no formal ADR acknowledgment, implementation permission or activation claim. Delivery's earlier position remains intact, exact memo SHA256 ce879402b2c622774af4a844b938d4df94042e6bc8d31ef80f8b8d27c1dc322b, root-supplied publication reference e8d355052234fb20e17db431d322c80ae6c7059a.

Reviewed all 17 manifest-bound files in Platform003, manifest SHA256 865c8ab775434e1d4b84484e68a8ee19eed24d5e21a934e801cae196f3b08de4, including the compensation schema, operational/financial event candidates and ADR-0006 amendment. Cross-reviewed Revenue002 manifest 70016cced1f8bd1558a5f51a884b4cd58d4d7d19a51cb8e7438a411446ccbfaf and its compensation-owner assessment. Source basis is preserved Delivery b53b08832582dea43fba0832be5eea2a480133d3. ADR-0052 is held. ADR-0050 is separately paused with its listeners and fixtures frozen; this review made no runtime or database calls to them.

Delivery-owned decisions for the assembled proposal

Delivery supports the first atomic transition protected g -> compensating g+1, Lesson Scheduled -> Canceled, operational hold held -> released, followed by Revenue's dedicated canonical writeback and only then compensating g+1 -> retired g+2. This resolves Delivery's earlier operational-mirror timing objection in favor of the proposed split, provided every consumer and protection rule below is included. The first receipt reports genuine operational cancellation and explicitly pending owner writeback. It never claims Revenue release, financial closure or replacement readiness. Revenue still owns financial eligibility and its ADR-0006 position.

Use delivery.lesson-hold.cancelled, schema_version 1, actor system:delivery, subject the original Lesson, correlation_id the exact compensation key. Its six existing payload fields remain: lesson_id, reservation_lock_id, organization_id, reason_code, originator and idempotency_key. Delivery proposes the dedicated semantic reason failed_close_compensation, originator revenue, and the rcomp1: key in idempotency_key. This is an internal compensation event subset. Do not append this reason to the ordinary hold-cancel request enum or invoke its refund-capable helper. No second scheduling cancellation event is emitted by finalization, and no credit event is produced by Delivery. The event schema's description must reference scheduling README section 4.7, not section 4.6, which now describes lesson-site reads. Event/reason consumer compatibility remains a joint assembly gate.

Approve the proposed two closed operations under the same new POST route and sole compensation scope: reservation.bind.compensate, key rcomp1:<intent UUID>, and reservation.bind.compensation.finalize, key rcompfin1:<finalization UUID>. Each gets a separate permanent command identity, fingerprint and exact raw result. The four new service policies remain four; no widening of bind, ordinary cancel, settlement or generic retirement policies is needed. The separate evidence GET reads Revenue-owned authority and later writeback proof without changing state.

The exact initial Lesson field whitelist is status=Canceled, cancellation_reason_code=failed_close_compensation, canceled_at and outcome_changed_at equal the retained operational decision time, outcome_version 0 -> 1, and normal updated_at. Retain cancellation_reason free text, details_version and all original resource/financial association fields. The exact operational lock whitelist is state=released, released_at equal that decision time, lock_version v -> v+1, and updated_at. Preserve funding_sub_state, airtable_status, reserved_at, resolved_at, resolution_reason, debit indicators and all account/reservation/Market/Lesson pointers. Those existing mirror columns are not permission to fabricate canonical Revenue release. A genuine later financial fact may be recorded and projected only through its approved incoming-fact path. Persist compensation association and pending-writeback assessment in the dedicated journal/continuation, not by changing original financial provenance.

Required resource and guard patch notes

1. Map retained IDs explicitly. Association.reservation_lock_id is exactly continuation.lock_id, Lesson.reservation_lock_id and original ReceiptRef.reservation_lock_id, not a new lock. Rename the draft booking.lesson_config_id to lesson_site_config_id before acceptance, or explicitly declare that it aliases that exact retained identifier without normalization. Source booking.coach_profile_id maps to wire coach_id; all Participant/site/type/area/window mappings are exact. Order/account/Market come from the original Revenue evidence and frozen booking. Compare original ReceiptRef and its raw response hash; do not reconstruct it from current rows. No old receipt or continuation booking JSON is renamed.

2. State/check/index migration is mandatory. The current continuation permits only protected/retired, and its two partial unique indexes cover only protected. Add compensating with a permanent exact compensation reference and phase-specific check constraints. Keep UNIQUE active Lesson and lock over both protected and compensating. Independently enforce UNIQUE original bind plus consumed generation for compensation and UNIQUE compensation plus finalization generation. Conflicting fresh keys cannot consume an already claimed generation. Permanent command/receipt/evidence/finalization tables deny UPDATE/DELETE/TRUNCATE of immutable artifacts and have no TTL.

3. Extend every OLD and NEW association match. Keep the existing guard's previous/proposed row iteration, and match both protected and compensating continuations. This covers the named Lesson/lock, Participant, site/config/access link/type, attendance correction/deletion, closure operation/admission and indirect Market/coach/ownership rows. Do not allow an unrelated row sharing a Person, Market or config to inherit a compensation exception. Append genuine incoming facts and attendance observations, preserving unresolved application status; they are not automatically safe progression. Late contradiction must remain recordable and prevent inappropriate finalization.

4. Require durable authorization for the narrow exceptions. Under the existing schema advisory barrier before row locks, lock permanent command/continuation, Lesson and lock in one fixed order. A transaction marker only selects a journal, it grants no authority. Validate exact journal operation, immutable authority/receipt/digests, source generation and row identity plus the field whitelist above. The journal's pending receipt state and terminal response write must form a verifiable transaction protocol, so the trigger does not require a completed receipt before the row effects needed to produce it. Deferred consistency checks at commit must prove marker, continuation, named row transitions, once-only audit/outbox and stored receipt agree. Any missing component rolls back the entire local transaction. A generic retire marker, owner token or matching IDs alone never bypasses protection.

5. Protect slots and original obligations independently of status. Source assertSlot reads Lesson status, so Canceled currently stops blocking. Add protected/compensating retained coach/window overlap to every booking/admission/availability path that can commit, including raw SQL and old/indirect writers. Apply the original-obligation replacement blocker even when the original Lesson is Canceled. Unique Lesson/lock indexes alone cannot prevent another Lesson in the same slot. Views may show cancellation while still showing recovery blocked. Generic credit.released handling and ordinary retireBoundProtection may not clear compensating protection.

6. Freeze version limits and source observation. The draft uses safe-integer Revision for lock/outcome versions, while Delivery stores them as PostgreSQL integer. A compensation lock source must be <=2147483646 for one increment; resulting lock_version <=2147483647. Retain exact v -> v+1 and outcome 0 -> 1 equality checks. Protection revision is bigint but JSON safe-integer bounded: first compensation must leave room for both increments, g<=9007199254740989, finalization g+1<=9007199254740990. Add expected_lesson_details_version to command, authority, fingerprints and receipt evidence, or freeze an equally explicit local source snapshot/version precondition before authority issuance. It is a current authorized observation, not an invented field in the old bind receipt. No overflow, rounded number token or schema-valid nonincrementing result is admitted.

7. Same-key historical replay differs from initial source admission. Current bindContext/ownedLesson re-read current resource activation before original receipt replay, and ordinary retirement knows only protected->retired. Introduce an explicitly approved historical association path for original/compensation/finalization receipt disclosure. New soft/create and new bind still require active exact original Person/tenancy and current booking eligibility. Exact historical replay and failed-close unwind use retained admitted provenance with fresh service reach and Platform's verified original pair/lineage. Archived Person or paused/inactive original tenancy is allowed for that narrow unwind when the original association verifies; merged lineage attaches separately without re-keying immutable bytes or inheriting target tenancy. Missing original association, unverifiable lineage or authority unavailability remains pending, with no new effect or guessed disclosure. Do not re-run current coach/site/type/geography activation as new-booking eligibility for immutable replay or this exact unwind. Active invalidation at the actual commit instant would require a separate real fence, not HTTP under a local lock.

Quiescence, schemas and compatibility

Support Revenue's irreversible no-old-sender/no-new-collection authority, retained terminal attempt/fact digest and dedicated unfunded writeback. Its authority must distinguish original payment/internal-writeback quiescence from future compensation-writeback work, and preserve all genuine later observations. Finalization uses a fresh owner_writeback_completed read of the same immutable authority plus exact Delivery receipt and writeback proof; it rechecks retained contradictions under Delivery serialization before its g+1 CAS. It changes no Lesson/lock version and emits no cancellation. An ordinary abandoned response or credit event is insufficient. No DB transaction or lock crosses owner HTTP.

Platform003's closed unions and separate externally hashed receipt are structurally suitable. Keep the accepted original ReceiptRef schema and all raw bind/settlement bytes unchanged. Require semantic redundant-field equality and digest preimage verification beyond JSON Schema. Because compensation fingerprint deliberately excludes its derived authority digest to avoid a cycle, the recipient must reconstruct both digests and compare the full normalized stored command on replay; same key/fingerprint cannot accept a changed authority digest or embedded association. Add independent raw-boundary and derived-field corruption vectors, including both valid original bind UUID v4 and v7.

WritebackProof currently fixes revenue_funding_state=pending_funding after release. Revenue003 now supplies the proposed owner mapping and mandatory Order event inventory, reviewed in the joint disposition below. Formal assembled approval remains held. Delivery supports no ledger/balance/refund/forfeit/customer.handoff effect and one Revenue financial release event with its own decision time. Delivery does not approve Revenue's missing private storage/drain plan or sign its financial authority. The proposed ADR-0006 amendment correctly confines the new reason to reserved/unfunded original work; add the source/target field mapping, consumer blockers and exact writer exception obligations above before joint disposition.

Parent scheduling 2.1.0 and credit 3.6.0 remain conditional, not automatically additive because wire schemas are preserved. Existing obligations that Canceled/released frees a slot, §4.1b's abandoned-after-bind ordinary hold-cancel instruction, §4.7's automatic financial implication and generic financial-event retirement need explicit v2/compensation amendments. Preserve every unaffected v1 flow and the ordinary request enum. Name and migrate affected consumers; if their required terminal/availability duties break, use a major with migration instead. Identity 1.6.0 also needs the scoped 9.5 immutable-history exception; ordering v3 descriptor/trust changes are independently owned. Platform003's source-pins still names Revenue's earlier 71a864... artifact, so the assembled package must repin or explicitly retain/dispose the newer 70016cce review; draft version labels alone do not establish compatibility.

Joint disposition of Revenue003, still proposed

Reviewed Revenue003 owner memo 2026-10-02-revenue-adr-0053-compensation-writeback-review, exact SHA256 ca51ea51c4738be7ff7cf81be3d62913637aaada26a51b440e1fac53b9420413. This revised Delivery draft preserves the prior Delivery002 manifest e77dbe2c79384bff6441b86d482b052099545f4a9906ced8e2b635ff8b645c3a and memo 2ff0a178ef285abfcaf92c96dd174fe89520804ac6ef40c316364ad674cca0b2. Revenue's new proposed decisions resolve the previously unspecified financial event inventory and wire mappings. They do not grant executable authority or formal approval of Platform003.

Delivery agrees that the observer must separate immutable authority and writeback from current_assessment. A fresh as_of alone cannot renew quiescence or establish current eligibility. Add a closed current_assessment to AuthorizedEvidence and CompletedEvidence, and a consistent blocked assessment to pending/denied evidence where the association can be disclosed. Keep a nondisclosing missing/foreign association outside these variants. Freeze the exact schema before implementation. It must correlate the same Association, CompensationIdentity and AuthorityRef, carrying assessment_revision, observed reservation/intent revisions, current compatible writer epoch and permanent sender-barrier identity/state, current lifecycle/funding/continuation phase, retained-facts digest, unresolved-work/contradiction verdict and eligibility for the exact compensation or finalization operation with closed reason codes. The current route/query policy remains unchanged; determine the assessed operation from the retained phase/operation context and echo it explicitly, rather than silently adding a query member or fifth policy.

Define assessment_digest over a closed AssessmentDigestInput containing the correlated identity, authority reference and every assessment field except assessment_digest itself. Specify whether observation time belongs in that input, and freeze one rule and cross-language vectors; do not hash a loosely shaped current row. Keep AuthorityDigestInput, frozen admission revisions and original ReceiptRef/result bytes unchanged. Add order_updated_event_id to WritebackProof and WritebackDigestInput before initial acceptance; keep prior draft bytes preserved rather than rewriting an already accepted or stored proof. Cross-check enclosing authority, command, compensation receipt, writeback and current assessment together. Structural validity and a matching proof digest are insufficient if those references disagree.

Frozen admission revisions may be less than current observed revisions. Specify the permitted protected -> compensation-writeback -> abandoned progression and approved writer-epoch compatibility, not blanket revision equality or permission from a larger number. Current phase, sender barrier and retained-fact assessment must authorize the requested new effect. A missing/obsolete barrier, changed association/receipt, unknown provider/internal work or contradictory retained fact blocks new compensation/finalization and keeps local protection. Delivery obtains this bounded fresh read outside locks, then rechecks its own current facts and exact phase under the local barrier. Revenue's irreversible no-new-collection boundary and compatible writeback serialization remain mandatory; the snapshot is not an inter-domain commit fence. Genuine late facts remain recordable and can require reconciliation without reopening original collection.

Historical completed compensation/finalization receipts replay their exact immutable bytes even if current_assessment is blocked. That disclosure does not reexecute cancellation, revive a retired source or prove replacement readiness. Do not put a changing assessment into an immutable result body. The first compensation receipt's owner_writeback_pending=true remains its historical first-commit observation after writeback; the fresh observer alone reports subsequent progression. Sales and resource consumers must inspect the current assessment and separate finalization proof rather than reinterpret that historical receipt as current state.

Delivery supports Revenue's mandatory order.updated@1 and credit.released@2 in the same owner writeback transaction. The proof retains both event IDs, exact original Order/reservation, compensation-key correlation and the retained financial decision time. Across the composed protocol the intended inventory is one Delivery operational cancellation event, one Revenue credit-release event and one Revenue Order-update event, with zero ledger entries and unchanged account balance. Any missing event, state, audit or proof rolls back Revenue writeback. Same-key replay emits none again; Delivery finalization emits no second operational cancellation. Reconcile order-flow's known CANCELLED spelling with actual DB/publisher CANCELED explicitly. Delivery does not author or duplicate Revenue's Order payload or adjust the immutable operational decision time to its later financial time.

Accept Revenue's proposed compensation-dialect mappings pending_funding for retained DB PENDING_FUNDING on the released historical reservation, and Canceled proof display for DB CANCELED. These assert historical unfunded/canceled facts, not an awaiting-payment continuation or permission to collect again. Financial events keep their canonical DB vocabulary. Credit reason documentation must explicitly describe the reserved-only, zero-debit/zero-ledger compensation case instead of implying an Adjustment for every release.

The Sales pending adapter is an explicit assembly/activation gate. Receipt of either or both financial events cannot clear compensating protection, free the original slot, enable replacement, complete a Sales recovery journal or restart collection/cadence. Show truthful operational cancellation with owner-writeback/finalization pending until the exact g+2 finalization proof and current authoritative resource assessment establish the approved terminal outcome. Response loss or contradictory current assessment remains pending even with historical receipts. A new replacement booking still requires its separate current active resource/admission authority. Root must name and review this adapter plus other affected event/availability consumers before settling parent minor-versus-major versions.

Platform must incorporate these fields, the event proof and semantic three-way equality/digest checks into the assembled package. Delivery supports these proposed amendments jointly with its exact row whitelist, slot/unique/OLD-NEW guards and historical rules above. Formal acknowledgment remains withheld for the corrected assembled schemas and owner/consumer/writer review. No runtime compensation, financial writeback or ADR-0050 producer request is authorized by this disposition.

Evidence and handoff

Independent Delivery offline review compiled the referenced schemas and passed 22 structural checks: ten positive examples, ten extra-field denials, pending-plus-authority rejection, and confirmation that a nonincrementing revision still passes shape validation and therefore requires the semantic guard. This proves schema structure only. Two additional structural checks in this revision demonstrate the stale-as_of/current_assessment schema gap described below. No auth, SQL race, runtime, event, financial or production gate is satisfied by these vectors. Source remained b53b088 with no tracked edits; no Delivery test suite was required for scratch-only design review.

Formal acknowledgment stays held for the assembled corrected schemas, history/version and consumer amendments, exact owner SQL/epoch/drain/rollback plan and Revenue's writeback/event disposition. Later isolated source-pinned real-handler tests must cover all OLD/NEW and slot/replacement races, old writer rejection, contradictions, full same-key replay, every marker/audit/outbox/receipt/writeback failure, response loss, finalization uniqueness, immutable history and no owner HTTP under locks. Original ADR-0052 proofs do not cover this new operation.

Live inbox/ledger were refreshed during review. This draft completes no canonical commitment and is not filed/indexed. Root is sole publisher/indexer/freshness owner; copy this exact reviewed memo into the permitted Delivery coordination clone as part of the approved batch. Only Delivery scratch changed. No canonical contract/ADR, runtime source, service configuration, fixture or provider state changed.