Authorize the exact guarded Emerson identity repair after database proof

Platform clears the guarded-repair authorization decision for Coach coa_3ff0f8c9-f8cf-444d-b1d0-e06d3f84c37d, Organization org_01900000-0000-7000-8000-000000000001, operation adr0051-emerson-coach-person-repair-v1. The private input SHA-256 is 440ffbce9a02edb6b5124291e5ca098019c360601850a2e39136a800c38f9c8d. No other Coach or backfill is authorized by this decision.

The operator explicitly authorized coordinated production changes and mutations, verified in chat 01a0e095-f279-7fd0-a8ef-92ce8f9547fc and reflected by the invoked coordinator skill. This decision applies that authority to the concrete procedure reviewed below. The necessary Platform effects are one active canonical Person, its transactional person.created fact, one active tenancy for the existing Organization, and one projection of this already-active Coaching role. Coaching's own Coach link and audit remain separately domain-owned.

Reviewed procedure

Platform source is pinned locally on codex/adr0051-repair-check at df01947, based on 3b0ef9d. scripts/repair-adr0051-emerson-person.ts defaults to dry-run and requires the exact file hash, an explicit apply flag and process-only apply enablement. The coordinator executes from that pinned checkout, not the evolving portal implementation. The working registry adds only the exact published person.created entry; unrelated registry differences are preserved.

The apply transaction acquires fixed-order table locks for Person, tenancy and role, then rechecks all-status phone, supplied-email and exact-name candidates. Any candidate requires review without mint. All four effects commit together. Replay requires the exact Coach, Organization, operation metadata, active canonical Person, unchanged normalized contact fingerprint, matching name and active tenancy. A conflicting or incomplete footprint fails closed. Bounded serializable retries do not create another identity.

Evidence and execution limits

• The coordinator independently repeated five actual PostgreSQL proof groups: independent concurrent connections yield one mint and one replay; tenancy and role failures roll back all effects; a non-participating direct writer is blocked; replay checks operation ownership and contacts. The dedicated random loopback database was verified dropped. The shared mesh database was not used.
• All standard test components passed in a separate dedicated database: 367 unit tests, 32 identity integration cases and 3 geography cases. Eleven repair logic cases passed, typechecking passed, and 16 focused dispatcher registry/event tests passed after narrowing the mirror diff.
• Coaching's fresh read-only preflight confirmed the Coach remains active, unlinked and in the same Organization, with unchanged private contact input. Platform's 2026-10-02T21:41:35Z database-enforced read-only preflight again found zero candidates and zero writes.
• Coordination PR 2 merged as 2120a90bfb87fb0ccfc7f16cbcb46a1fcdd88894; the contract, registry and payload schema are published. CI validation and ledger indexing passed, followed by canonical freshness at 21:39:59Z.
• The inspected live Render revision d61bae6 explicitly excludes platform-warehouse from webhook fanout. The new fact has that sole registered consumer. No application push, runner restart, intake event or customer communication accompanies this repair. The ADR-0049 coordinator identified no overlap with its target checks or event types.

Apply must rerun candidate checks under the locks, retain a redacted outcome report, then repeat the exact operation and prove a zero-write replay. Read-only postchecks must verify the canonical Person, exact tenancy and role, and one full ten-field creation fact. An uncertain result is reconciled by the same operation key, never by a new mint or destructive compensation.

This clears authorization only. emerson-platform-person-mapping-ready remains uncleared until the actual mapping and replay are verified and published. The new portal endpoint remains subject to its separate deployment and workload-exchange gates.