Coaching local protection migration proven with production source and serving gates open
Assignment ADR-0053/coaching/004, shared release ADR-0048-scheduling-20261003, coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc/local. Read-only preparation only. Root remains sole canonical publisher. No deployment, flag, schema, role, financial, runtime or fixture mutation was performed. Existing 63335 and 53125 listeners and immutable historical checkpoints remain intact.
Serving source and prerequisite chain
Vercel deployment API and current project target agree: canonical production deployment dpl_7oinq9vMFUm28MqWZTtKjZAwjoyh, URL coaching-nrpjjr7c3-jack-allreds-projects.vercel.app, state READY, source metadata 4b2857f7b11f59546a43727c66c0174cf05c113e, ADR-0051 branch codex/adr0051-coach-person-creation. This is deployment source metadata, not a claim to have extracted or verified every served bundle byte. Safe API snapshots are current-deployment-safe.json and current-project-safe.json beside this memo. Project prj_sKBkMlnYoqcu8EhvdLG8UD7zhz3q has Git production branch main, but that setting does not replace the observed deployed source pin.
Both branches share 6fa12c3110e9bb0513d54ce1fd73ea0926f21506. Preserve the serving chain in order:
c39f99e7f7a3b68099ffb75e529092edc5514fbe: durable Person resolution and Coach creation attempts, related operator paths and schema.8a990bc1645e9ad56a3bb761b3d3ba1f4d009a69: gated fixed production Coach resolution release proof.1099f2ca8542883d640de2007ac31092b9a93e6e: removes implicit migration from Vercel build.4b2857f7b11f59546a43727c66c0174cf05c113e: supported Node 24 runtime.
Integrate the separate protection chain: 00aa41d7a3e487a135b25247bfd8f12a763bb57f implementation, a860ecb76b0b388940daf53eb5127d8f04db69bb bounded producer proof, 0587f106520cd60671e7eaf4be148049787f829d audited composition harness, and 8dfd8a37208579f8f7bcc7612e21d4f63cc89a5d deferred-constraint deadline repair. No combined candidate exists from this task. Do not deploy the standalone protection branch: it lacks current Coach creation work and retains older Node 20 and implicit-migration build settings.
The integration review must reconcile modules/operator-console/repo.ts, modules/ops/repo.ts, package.json, lockfile and prisma/schema.prisma, regenerate the combined Prisma client rather than choosing one branch's generated files, preserve existing operator authorization and Coach creation behavior, keep Node 24, and retain npm run prisma:generate && npm run build without migration in the build. Combined-source tests/build and regression evidence are required only once the combined candidate exists; earlier exact-source results do not prove an unbuilt combination.
Configuration and exact serving role
Current project environment metadata has no COACHING_SCHEDULING_PROTECTION_ENABLED or COACHING_PROTECTION_WRITER_EPOCH. Production DATABASE_URL and DIRECT_URL are sensitive entries. Prior clean-directory export returned empty/unusable values; do not infer their contents or substitute .env, local inspector or deploy credentials. Current project configuration is not exact already-serving process attestation.
No authorized read-only serving-process DB diagnostic is exposed by the reviewed source. ADR-0051's release proof is a Person-resolution workload probe, not a DB-role proof, and was not invoked. Exact serving current_database, current_user, session_user, schema/search path, superuser/BYPASSRLS status, effective table privileges, pooler role and deployed protection flag/epoch therefore remain unverified. An owner-approved serving-context read-only attestation must report those facts without exposing credentials. A separate deploy-time DIRECT_URL migration connection cannot establish runtime-role identity. Production Platform fresh Coaching issuance and Delivery compatible observer/epoch require corresponding serving-context evidence before activation; no local epoch 3 inference is allowed.
Migration history and guards
Serving source contains the historical migrations through 20260527110000_rebook_intent_protected_intervals, plus 20261002220000_coach_creation_attempt. Protection adds 20261003034000_scheduling_protection_observation, SQL SHA256 704f4a2cf9dcf6b666035727fa6c95a39620557f7affc779f2867542e769521d. Required production preflight is read-only _prisma_migrations history/checksum/finished/rollback inspection and catalog comparison against the combined source, including the existing Coach-creation table. Presence in Git is not proof of application. Production migration history and table existence are not verified here.
Before any later authorized schema change, verify the explicitly targeted production DIRECT_URL and schema, use prisma migrate status, and have the release owner resolve any historical drift from evidence. Never run db push, a local seed or blind migrate resolve against production. The additive table has a nondeferrable composite primary key, no foreign keys or triggers. Grant/role readiness must cover only required initializer INSERT and observation SELECT/UPDATE/invalidation capabilities, not DDL authority in the serving role. Review effective privileges and all actual triggers/constraints for drift. Set bounded deploy-session lock/statement budgets and apply through the explicit migration process, then recheck history and catalog. Do not edit the proven migration checksum casually to introduce guards.
Existing isolated SQL evidence migration-rollback.json proves transactional DDL rollback, additive apply, sentinel preservation and observation rollback in database coaching_adr0053_dc3fa16c1e484207983d9998fec3e465. Seven actual persistence tests at 8dfd8a3 include lock delay and deferred-trigger delay rollback, preserving records/revision/generation. The save path drains SET CONSTRAINTS ALL IMMEDIATE within a refreshed remaining timeout and checks its monotonic deadline again. This does not claim a hard bound on network acknowledgement or WAL flush. No tests were rerun in this unchanged read-only review.
Relevant entrypoint and retained-writer inventory
| Surface | Source and effect | Release treatment |
|---|---|---|
| By-description/by-lesson eligibility and free intervals | app/api/v2/coaching/eligibility/{by-description,by-lesson} and /availability, modules/availability/service.ts |
All must serve the combined protection overlay; ordinary exclusions cannot erase it. |
| Operations supply and coach weekly/calendar preview | modules/ops/repo.ts, modules/operator-console/repo.ts, weekly-preview.ts |
Preserve current Coach creation/UI behavior and separate protection identity/travel/unavailable state. |
| New durable obligation writers | scheduling-protection/repo.ts load initializer, serialized CAS save, generation invalidation |
Only accepted exact observation retires; retained history must not be cleared. |
| Authenticated dispatcher inbox | dispatcher-inbox/service.ts, dedup repo and availability/bookings-repo.ts |
Verify events invalidate before dedup, ordinary scheduling/credit/reschedule/cancel/delivered/rebook writes stay independent. Old workers must not supply authoritative availability. |
| Ordinary projection maintenance | backfill-booking-zips.ts, backfill-delivery-lessons.ts, backfill-comp-april-may.mjs, rekey scripts, Coach Airtable migration |
Retained source entrypoints, not evidence of active processes. Preserve ordinary facts; any scheduled/manual execution needs inventoried owner and target. None writes the new table at reviewed source. |
| Local seed/proof writers | seed-local-mesh.ts, mesh-dispatcher-proof.ts, prove-* and scratch launchers |
Local-only guards, no production execution; preserve old evidence databases/listeners. |
| Serving ADR-0051 writers | modules/coach-creation, coach-person-link, operator/ops actions and role publication |
Preserve durable attempts, Person provenance and existing feature configuration; no replacement with pre-ADR-0051 actions. |
| Retained Vercel deployments and immutable URLs | retained-deployments-safe.json |
Listed deployments are potential retained entrypoints, not proof of active traffic, credentials or writer quiescence. Inventory alias/protection/routing and old credential reach before cutover. Do not delete or disable them during this preparation. |
The deployment inventory contains 20 unique visible rows and records its remaining cursor explicitly. The CLI API pagination attempts returned the same rows/cursor; duplicates were removed and pagination is marked incomplete. This is not a complete historical deployment census. Source inventory is complete for reviewed paths; runtime reachability/quiescence of retained immutable deployment URLs, cron/manual jobs and external subscribers is not attested. That operational census is a release gate, not silently inferred from the canonical alias. Coaching does not control other domains' sender/admission barriers.
Disabled deployment, cutover and rollback plan
- Root pins a combined release candidate preserving the full live ADR-0051 chain and protection chain. Keep activation absent/false and existing product settings intact. Validate combined schema/client, owner code review, relevant suites/typecheck/build, and preserve exact build/source evidence.
- Obtain exact serving-context role/config proof and independently verify deployment migration history/DDL privileges. Apply only approved additive migrations explicitly, with root-controlled bounded migration execution. Build must not perform schema changes.
- Deploy the combined binary with protection disabled, wait for READY, verify exact deployment/source/alias, and perform read-only existing-product smoke checks. This is disabled readiness, not protected admission readiness.
- Root verifies every producer/consumer epoch, current Platform audited workload policy, Delivery complete observer, ordinary occupancy, unavailable/overflow/performance behavior and old sender/admission barriers. Inventory and contain retained incompatible serving paths. Pin the actual production epoch only from owner evidence.
- Under the shared cutover, enable the compatible protection consumer and verify fresh workload issuance, same-clock observations, durable persistence and user-facing eligibility/free-interval/travel/weekly behavior before permitting dependent compensation/admission paths. No production business proof is authorized by this memo. Ordinary events/fanout are not substitutes for authoritative observation.
- Before protected operations are admitted, root may revert the disabled combined binary to exact prior product deployment if needed, retaining additive tables and all current ADR-0051 product state. After protected operations are possible, never independently disable protection or restore a legacy affirmative-availability consumer. Root pauses new admissions, retains compatible observer/recovery and obligations, and restores only a verified compatible binary. No table drops, record clearing, financial reversal, provider retry or historical fixture cleanup belongs to rollback.
Commitment assessment and retained proof
The existing commitment to migrate eligibility, free intervals, travel and weekly preview is satisfied as local implementation and exact-source consumer evidence, including actual held-original g0/g1/g2. It is not a completed serving migration: no combined production candidate, migration/role proof, compatible deployment or activation has been demonstrated. Keep its existing working status and record the local milestone without inventing or duplicating a commitment. Root may refine the milestone split with owners, but this memo does not mark production complete.
Actual local consumer source 8dfd8a37208579f8f7bcc7612e21d4f63cc89a5d, G2 artifact .tmp/adr0053-eligibility/third-finalized-checkpoint.json, SHA ff93e6964d0bb59a8f3a2178d165224a3310784215db8fb781dedc99574828a0: active empty plus exact-original retired g2 at epoch 3/clock 86, durable row generation 10, original immutable history retained, interval fits, two matching fresh issuance audits. G0/G1 and all prior source/evidence pins remain unchanged. This is actual local owner lifecycle under synthetic workload, not production readiness.
Concrete remaining gates: combined exact source/build; production migration history and additive table/privileges; exact serving DB role/config attestation; Platform/Delivery production workload and epoch compatibility; retained writer/endpoint containment; combined product regression and bounded runtime capacity; shared cutover and compatible rollback ownership. No user approval was requested for routine preparation, and no production mutation was attempted.