Delivery unbound-soft owner disposition
Assignment ADR-0053/delivery/005, coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc/local. Proposed scratch owner memo for sole root publication. Source b53b08832582dea43fba0832be5eea2a480133d3. Reviewed Sales005 memo SHA256 0884d0b6746a8139a62905f7c2d83883a0c988f0684cddd7a17ff2aa0a56fcf7, artifact manifest 9dced9650236e48f7f7ed89e1c57c66c7ce7d4b896d6e9e684fb0bba8eb3fcc0, proposal be279eb7044af15867c18372aa8e628324f451228b81265f9cc04c1d01e14834 and schema a1e5eaf7f5f0830591dada60399af61f5b060e4c88b527f32b35a619064668d7. All nine manifested artifacts match their hashes.
Disposition: accept Sales' bounded owner-expiry/read architecture with the exact journal/fence and closed-schema amendments below. This is a focused owned design disposition, not formal whole-package ADR acknowledgment, runtime authority or installed policy. The additional soft-resolution read is the sixth new ADR-0053 policy, including the separately reviewed Coaching read, not a fifth. All previously accepted mutation permissions remain unchanged.
Source-backed feasibility and eligibility boundary
The permanent v2 scheduling_command already retains tenant/Organization/subject/operation/key, original and normalized command, fingerprint, raw request, exact successful response text/status and Lesson ID. Its soft-create operation does not use bind_intent_id; derive admission_id from the exact stored ssh2: key suffix, not the nullable bind intent column. The existing receiver accepts v4/v7 soft UUID suffixes; this new Sales-admission read deliberately covers lowercase UUID-v4 originals only and does not rewrite other historical keys.
Current soft creation saves 201 soft_held result bytes including immutable original expires_at. The v2 bind checks SoftHeld/unexpired state under its scheduling transaction after remote checks, but requires amended all-writer soft-lifecycle guards. The old expiry executor locks the Lesson, rechecks status/lock/TTL, writes Canceled plus soft_hold_expired fields, increments outcome once and clears current TTL. It emits no event and returns Lesson IDs only. Neither that row nor its old return value is an expired_unbound receipt or permanent fence. The existing authenticated /api/cron/soft-hold-expiry runs every five minutes, maximum duration 60 seconds, default 200 candidates. This is an existing executor shape, not proof the proposed new journal is implemented.
Install the compatible soft-lifecycle epoch/guards before admitting eligible originals. Add an immutable soft-resolution admission sidecar at successful soft-create commit, keyed by exact soft key digest with permanent UNIQUE(original Lesson ID). Preserve original scheduling_command/receipt bytes and all raw digests. Sidecar records original identity, original full booking/resource snapshot, original expiry, creation epoch, supported eligibility marker and initial phase live_unbound/revision 0. Only originals whose complete lifecycle was protected from their creation by this compatible barrier qualify for positive resolution. Do not backfill an older admission's never-bound history from current SoftHeld/null lock, a TTL cache, a missing bind row or today's resource snapshot. Unverified older history returns blocked/historical_authority_unverifiable. This prospective subset does not invalidate original v2 historical receipt disclosure or reopen/re-admit it.
Derive the immutable identity only from the original permanent journal and exact stored successful 201 receipt: tenant, Organization, subject sales, UUID-v4 admission, ssh2:<same UUID>, original soft key digest/fingerprint, original Person/Lesson, raw response SHA256 and original expires_at. Validate the original normalized command with scheduling 2.0's existing normalizer, original namespace/subject and fingerprint algorithm, and compare original receipt first_lesson_id=lesson_id, null reservation_lock_id/reservation_id, soft_held, exact Person/participant/coach/site/service-area/type/window and original expiry. Sales compares the returned identity with its saved original command and validated raw receipt; mutable Lead selection never substitutes. Exact successful soft-create replay remains byte-identical and creates no Lesson or phase again, with current historical authorization before disclosure. Missing original result is recovered only by that admitted same-key operation, never a fresh key.
Owner expiry and permanent fence
Expiry and all bind/repoint/revival/TTL extension/deletion/recreation writers serialize in the same compatible schema-entry barrier, then exact soft sidecar, original Lesson and relevant local source rows in one prescribed order. Sidecar binds are keyed through the original Lesson as well as the command key: a new bind key or competing reservation cannot evade the terminal fence. Eligible soft creation, bind and expiry atomically keep the sidecar synchronized. A successful fresh bind irreversibly records phase bound/revision 1 with its exact bind command/receipt association. Bound history can never become never_bound through later release, cancellation or repointing.
Owner expiry is a local operation, never the GET. Under locks recheck live_unbound revision 0, original unextended expiry reached using the database decision clock immediately before writes, unchanged original associations, pristine eligible source, null lock, no ever-bound journal/fact and no unresolved or contradictory staged work. Atomically commit: the exact original Lesson cancellation, source phase expired_unbound/revision 1, immutable resolution receipt, durable audit, permanent no-bind/no-revival fence and retry-work completion. Any missing part rolls back. No canonical financial event, reservation/account mutation, refund, credit debit, ledger entry or bound compensation finalization is authorized.
The Lesson expiry whitelist is status Canceled, cancellation_reason_code soft_hold_expired, cancellation_reason 'Soft hold expired before bind', canceled_at and outcome_changed_at at the retained canonical local decision time, outcome_version incremented once, soft_hold_expires_at null and ORM updated_at. Preserve details version and every original association. Do not clear the immutable original expiry in the sidecar or original receipt. Increment overflow or prior unexpected source mutation denies resolution rather than inventing a version. The observed null current TTL after cancellation is never its historical source of truth.
Use one append-only expiry-resolution row as BOTH immutable receipt and terminal fence; resolution_id identifies that row and terminal_fence_id equals resolution_id, not a second invented barrier. ResolutionReceipt adds source_soft_revision=0, resolved_soft_revision=1, terminal_fence_id and terminal_fence_digest. resolution_revision equals resolved_soft_revision. Compute fence digest over the closed TerminalFenceDigestInput: protocol_version, identity, resolution_id, source_soft_revision, resolved_soft_revision, decision expired_unbound, no_bind_or_revival=true, never_bound=true and resolved_at. Receipt digest independently hashes every closed immutable ResolutionReceipt field except receipt_digest. This dependency is acyclic: fence input excludes receipt digest. Preserve exact receipt JSON bytes and both complete digest preimages for repeat reads.
If bind commits first, expiry observes bound and emits no expiry receipt; GET is blocked bound_or_reassigned and Sales cannot retire from never_admitted financial evidence. If expiry commits first, every original/competing fresh bind, revival, extension, reassignment, delete/recreate and stale binary write is denied by the permanent Lesson-associated fence. An already committed original bind can disclose its immutable historical receipt under current reach but cannot execute again or become an unbound resolution. Genuine late facts remain durably captured, advance current assessment and may block positive retirement; they never erase the fence or rewrite the resolution. Old SQL/writers/cron and rollback cannot bypass these predicates merely by setting a session marker. Immutable evidence and guards have no TTL or cleanup/truncate exception.
Finite executor, retry and pause behavior
Amend the existing five-minute owner cron to select eligible sidecars by their retained original expiry, not only current SoftHeld Lessons. That keeps failed resolution work discoverable after attempted/source changes and prevents silent backlog loss. Process up to 200 ordered original obligations within the existing 60-second run, one transaction per original, retaining bounded attempt/error/next_attempt metadata outside immutable proof. Failed work retries on the next run with backoff capped at five minutes. After three consecutive failures or fifteen minutes overdue, emit an operator backlog item and keep pending; continue bounded retries until exact resolution or an explicit bound/contradictory reconciliation outcome. This is a liveness commitment, not a guarantee of completion during an outage.
Admission pause must block fresh creation/binding while preserving exact authorized reads, completed same-key replay and safe owner expiry of already admitted unbound originals. A full execution disarm is distinct and may prevent mutation, but preserves work/guards/receipts and exposes pending clearly. Rollback never restores old writers' ability to bind/revive a resolved Lesson or reruns creation. Production-capable default-off and split admission/recovery controls remain later integration gates; the current source flags do not prove them.
Exact read and amended wire
Accept GET /api/v1/delivery/v1/lesson-holds/soft-resolutions/{admission_id} with exactly one organization_id query, UUID-v4 path and sole scope delivery.scheduling.soft-hold.resolution.read, policy sales-production-to-delivery-soft-resolution-read-v1. No body, Idempotency-Key, Scheduling-Protocol-Version, command token reuse, generic inspect/listing, early expiry, financial authority or mutation. Platform supplies exact approved production issuer/project/subject/audience/tenant/Organization pins and current token rules. This is an explicit sixth additive policy in the unaccepted ADR-0053 assembly; remove obsolete four/five-policy caps, never silently reuse a neighboring row. Root assembles Scheduling 3.0 and the proposed read sub-spec 1.0; existing original wire 2.0 and its fixed 2026-10-17T00:42:57Z deadline stay intact.
Authenticate current workload first, then parse exact selector and obtain current historical access to the original Person/Organization using the already proposed Delivery-to-Platform resource-verdict policy outside business locks. Verify original merged lineage separately; current active identity is required for new admission, not safe local expiry or authorized history. Under the compatible local barrier read one coherent sidecar/receipt/fence/source/staged-fact snapshot, after bounded external reads. No owner HTTP under these locks. A read does not initialize journals, synthesize proof, run expiry or repair anything.
Accept Sales' closed pending/blocked/resolved_expired variants and separate historical resolution_receipt. Amend CurrentAssessment to include current_writer_epoch plus terminal_fence_id, terminal_fence_digest and terminal_fence_preserved=true. It correlates the same identity, receipt/resolution ID/digest, exact phase/revision, no-bind enforcement/never-bound flags, original resources, contradictions/unresolved work, retained facts and the complete current Platform verdict. Positive read requires compatible installed epoch and intact exact row/fence; a larger number alone does not establish compatibility. observed_resolution_revision equals the current terminal revision and covers the frozen receipt revision. assessment_revision advances for every relevant predicate/source fact, including staged facts; repeat unchanged observations can keep the same revision and new observed_at/digest.
Resolution ID may be Delivery UUID-v4 or UUID-v7; original Sales admission remains UUID-v4. pending/blocked may disclose an authorized historical immutable resolution receipt without granting retirement, and never changes that receipt to match current assessment. If lineage cannot be safely disclosed, use nondisclosing error, not a fabricated pending identity. Authenticate before artifact disclosure; 401/403/400/404/409/503 ordering follows the reviewed rules. Errors, 404, TTL, Canceled/null lock, an expiry job count or a receipt without current intact-fence assessment are not positive resource resolution.
Canonical digest inputs use scheduling canonicalJson, SHA256 over UTF-8, sorted ASCII object keys, preserved array order and safe integers with valid Unicode. Freeze serialization vectors for identity, fence, receipt and current assessment. Current assessment digest covers every closed field except its own digest, including observed_at and current_resource. Positive carries no mutable facts inside original create or resolution bytes. Enforce strict duplicate-free JSON and 32768 UTF-8 response bound separately from schema character limits.
Sales joins the exact Revenue never_admitted proof with this exact Delivery resolution/current observation. Delivery accepts Revenue006's owner addendum, exact SHA256 6bca4b162e7de568e93d009d4439da561546194dd03a08a5c5902e07c28ddbf5. Compare the full financial outer/nested identity and saved closed settlement including settlement_id/issued_at/digest, not merely a key/decision. The saved verified original descriptor bytes hash to descriptor_digest and its admission UUID-v4 equals both original sclose3 and ssh2 suffixes. Delivery identity tenant/Organization/original Person/Lesson matches that descriptor and saved Admission; soft key/digest/fingerprint/raw response hash matches descriptor.soft_receipt_ref and Sales' validated original raw response; expiry matches that same original receipt. Verify every independent full canonical receipt/fence/assessment digest and redundant original identity. Changed descriptor, Person/Lesson/Organization, admission suffix, raw-soft hash or otherwise same-identity changed settlement receipt denies this join. These are explicitly different owner shapes joined by original provenance, not coincidentally equal field names.
Revenue's original admission and permanent never_admitted insertion serialize under its exact registry/trust barrier: admission-first cannot issue non-admission; tombstone-first denies every delayed original close before construction, provider work or bind. No new key/body/descriptor, supported namespace, older worker, restart, expiry, rollback or retired-key timestamp evades that original fence. All financial constructors/senders/SQL/cron must participate or be denied. Delivery's expiry-first and bind-first outcomes remain separately serialized; financial absence says nothing about unrelated binds.
Use the agreed 10000 ms monotonic budget from before GET through local retirement serialization/commit. Expiry/refresh retry occurs outside locks. Neither proof alone completes this signed-original join. Append a distinct local retirement outcome, preserve original attempts/results, and require a new current human/resource admission for replacement. A bound/contradictory outcome is explicit reconciliation work, not permission for this read to perform bound compensation. A pre-sign/preparation failure without a valid saved descriptor cannot acquire a retrospective financial settlement. Delivery may resolve its original soft resource, but Sales/Revenue must separately prove no authorized financial send under their original journals; until that owner-authored distinct closeout is proven, do not fabricate the signed-original joint branch or claim the whole task retired.
Evidence and acceptance boundary
The adjacent corrected schema and closed fence preimage are owner-proposed wire, not installed runtime proof. Source-backed feasibility is established; real-handler expiry/bind races, atomic rollback points, original byte replay, late bind across new keys, old-writer denial, chronology/freshness, backlog recovery, historical lineage and policy isolation remain later proof gates. Delivery's structured conditional implementation commitment is declared above. No formal full-ADR acknowledgment, runtime, production, fixture, canonical code or foreign-repo change occurred. Coaching004 remains independently pending its assembly cross-review and was not modified by this task.