Unsigned attempt stopped and cleaned, local predicate corrected
Assignment ADR-0053/delivery/007, coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc/local. Root reviewed and authorized the prior 6cc183d runner and exact role-reuse plan. Its fresh baseline, uploaded source, cleanup and exact revoked-role preconditions passed. Reactivation of only OID 13362275, actual restricted login, effective grants and all five SQLSTATE 42501 denial probes passed for unsigned UUID ebe659cf-6da2-4d35-9fa3-aa003ab0a762.
The first encrypted env POST succeeded and its actual response shape is now observed: top-level created object and failed array, with exact newly returned ID cUe3T8qs2vAIwsR1 durably recorded. Subsequent GET matched that ID, key DELIVERY_PROOF_ENABLED, production target and absence from all 28 saved pre-request IDs. The local intent timestamp was 2026-10-03T08:22:41.043Z, while provider createdAt was 2026-10-03T08:22:40.701Z, 342 ms earlier. The helper's cross-system chronology check was too strict and rejected this known successful creation. No second create, diagnostic staging, alias change, signed approval or acquisition POST followed.
Only the successful response's exact ID was removed, after matching the current GET row and saved pre-request IDs. All diagnostic names are absent and all 28 business env rows plus settings retain their exact prior hashes. The role is again NOLOGIN/password NULL with own grants revoked and zero sessions; only this attempt's own pooled PID 1186326 was drained. Fresh readback proves zero audit rows for this unsigned UUID, zero production proof POSTs and the unchanged canonical baseline. Canonical proof-route POST returns 404; retained READY cleanup URL returns 302 deployment protection, without a route-404 claim. Live custody exited cleanly. Both this unsigned UUID and the previous 467b399c-e19c-40d3-829f-da3530ae300c are permanently stopped.
Latest stopped-attempt evidence in .tmp/production007/prepared-next/:
final-stop-proof.json:2f172a6fc64d8592aca040796fa7d504d0ab3f1e0e43dfa46e9366b833398601.state.json:e6514f959d4c44350af20759f2a174c835482650ab4f06b5dccf7f8b60c73467.exact-response-id-cleanup.json:3f18dec343c6b6ff2db9a512b33d91e2f8f5df5a8e3ce593172e4b42ebc74fbe.stop-absence.json:0fb3ccc9bfb7c6e3d4d2bed2d29eba4958d9709db15aaac8a0d7d8944ad88017.
Root explicitly directed the local correction and a fresh unsigned plan, with another final pin review before any production mutation. A validated successful POST's server-returned ID now establishes creation ownership when the subsequent GET matches exact ID/key/production target and the ID is absent from the saved pre-request IDs. This branch uses no local/provider timestamp comparison or clock tolerance. Persisted response metadata supports the same validation after restart and exact-ID deletion reconciliation. Unique-key, target, key, ID and preexisting-ID checks remain strict.
Unknown, lost, malformed or API-failed responses cannot adopt a GET-only ID or continue preparation. Their existing strict chronology checks remain, followed by a hard stop requiring explicit coordinator reconciliation. They never POST that key again. This narrows the fallback rather than inferring ownership from an arbitrary fresh-looking row. The authoritative-ID branch also fails on every mismatch, ambiguous key, preexisting ID or API-reported failure. No failed response is converted into success.
The 49 combined recovery and role tests pass, including both clock-skew directions, the actual minus-342-ms case, restart without duplicate POST, exact cleanup, mismatched/preexisting/ambiguous IDs, target/key failures, API failures and unchanged role preconditions. Node syntax checks pass. No unrelated application-suite rerun or artifact rebuild was performed for this predicate-only correction; the prior full 979-test, eight-audit-check and typecheck results remain unchanged.
New unsigned plan 8be1d3a1-c4ee-4eac-ac78-0d5c7b3b6a94 has no credential, key or signed approval. GET-only preparation at 2026-10-03T08:25:14.675Z confirms baseline alias/source/READY, exact READY cleanup dpl_6kMSVcQWqehL1sT6xAb78DjRrbPi, all 508 regular uploaded cleanup files, both reviewed artifacts, and the original 28 business rows/settings. Preparation SHA256 is 3eebb1faecd0e54e5190fb6a8e4d77aa4d29cdce63be0894c12a98c5e77d5258. Fresh role-catalog read at 2026-10-03T08:25:15.439Z proves the same exact OID, flags, password NULL, creator-admin link, unchanged PUBLIC baseline and empty dependencies/sessions, SHA256 ea4bef813867715329fc23158c107af2954a651462e63e92e94c008482385aa9.
Final local review pins in docs/adr0053-workload-proof/orchestration/:
fix-manifest.json:d30b9678114d8e4dac428f9c74b23b2ad63bed1087e9adee27ebfcff467df1de.custody.mjs:063181028ef83124e41f4bd932ed388ff73bea8952cc0a42f4de7155447e9d29.env-journal.mjs:68918d612c7a533bcda6dc84b45cc1d5e4cc79f581b688a8b86e5d23e4e293d0.env-journal.test.mjs:52b6e111c545fa28fe5b3c9afdf0ccaa5d76357149f140095d73ab241479bf3a.role-reuse-plan.json:15e3256b10500fe5923a40f1cbb241399a2dc82336dc1e78ca3e065ea8dfaf1a.
The manifest pins the minimal predicate diff, latest STOP evidence and fresh plan. The revised runner defaults to .tmp/production007/prepared-clock-fixed/, rejects either stopped attempt's directory, and pins the latest stopped provenance and fresh revoked-role readback. Exact role reuse, reviewed diagnostic fb4bf54cf033cf47f2642bdcafe28e4498e5e951, cleanup 5c36fd2021069d766b17f97032b4266c8d0b4f5a, seven-settings removal before approval, one bounded acquisition POST, immediate cleanup/revoke/drain and honest absence/audit/expiry evidence remain the required sequence. No further production mutation occurred after cleanup. Acquisition is still unproven, Phase C remains excluded, and G2 evidence, old runtimes and ADR deadlines remain preserved. Root owns final review and sole publication.