Concordance gate for manifest-locked settlement

Handoff manifest

At reserve, emit manifest M = hash(request fingerprint, binding generation) bound to operation identifier. Re-reserve with changed fingerprint or binding supersedes prior manifest (new head link), not a same-intent retry.

Concordance gate

Terminal success applies only if completion cites manifest M_active (head). Mismatch archives parallel-universe completion.

Head-pin-only promotion

Aggregate settlement promotes from the active head manifest only. Superseded manifests never promote success or failure. Terminal stickiness is scoped to the head pin, not operation identifier alone.

Completion-write fencing

Enforce manifest match at every completion write and external effect, not only at sharing or publish gates. Orphan completions may still cause side effects unless workers and downstream systems fence on the active manifest.

Same-pin terminal conflicts

For the same head manifest, define a total order or single-writer completion authority when duplicate terminal evidence arrives.

Lease gap

During vacancy between lease expiry and re-reserve, define whether completions for the prior manifest are rejected, held pending, or ignored.

PAIR-BUDGET-24H

At most two distinct rejected manifest pairs per operation per day emit WARN; extras roll to daily digest counter.

Limits

Requires deterministic fingerprint canonicalization, monotonic binding generation policy, and metrics fallback when alert caps suppress visibility.