Binding-matched monotonic operation settlement

Settle shared durable operations with reservation-bound locked merges so timeouts and stale successes cannot erase or hijack outcomes.

Trigger

Use when concurrent retries or observers settle one shared durable operation record, especially when a local timeout can race a late committed response, or when an operation identifier is reused across different request fingerprints or authorization binding generations.

Failure prevented

Prevents two regressions:

1. Timeout erases success — wall-clock last-write-wins lets a late observer timeout overwrite a matching committed success with unknown.
2. Stale success hijacks the record — blindly preferring every successful response attaches the wrong replay payload, stale authority, or false closure when the operation identifier matches but the request fingerprint or binding generation does not.

Practical steps

1. Single authoritative path. Only the tuple-gated settlement path may mutate authoritative operation state. Per-attempt timeout records, metrics, and side channels are non-authoritative for downstream gates.

1. Atomic first claim with eligibility. On first touch when no reservation exists, set the reservation tuple in one compare-and-set: operation identifier, request fingerprint, and authorization binding generation. The tuple is immutable within one reservation epoch. When a record already exists: replay on matching terminal completed, reject fingerprint mismatch, allow retry only from retryable non-terminal states under the same tuple, never overwrite an existing reservation.

1. Reservation epoch supersede. Binding rotation or request edit bumps binding generation and starts a new epoch. Atomically supersede: reset terminal and frozen result fields, promote aggregate to retryable non-terminal for the new tuple, and invalidate prior-epoch authority on the authoritative record. Prior-generation evidence at any rank is foreign even if rank fields were not updated separately.

1. Persist attempt observations separately. Store per-attempt timeout and transport details on attempt records; do not let them blindly replace authoritative operation state.

1. Locked three-stage settlement. Under one lock, transaction, or compare-and-swap on reservation tuple plus record revision:

• Stage A — tuple gate for every observation kind. Extract the tuple from verified server commitment evidence, not caller-echoed fields alone. Mismatch quarantines the observation on attempt storage and leaves authoritative state unchanged.
• Stage B — non-terminal rank merge only when authoritative state is not terminal. Rank: unknown, then lease-valid inprogress. Skip Stage B entirely when current authoritative state is terminal. Tuple-matching terminal completed dominates all non-terminal states including lease-valid inprogress.
• Stage C — terminal resolver. Tuple-matching completed dominates unknown regardless of arrival order. For two tuple-matching completed observations, compare result digests: same digest strengthens idempotently; different digest enters explicit conflict terminal and surfaces an invariant break — never silent last-write-wins. Apply explicit policy for completed versus failed under one matching reservation.
• Observer-local timeout is low-rank unknown evidence. Tuple-matching committed terminal is high-rank.
• CAS failure protocol: on compare-and-swap failure, re-load reservation, lease, and revision; re-run all three stages; never blind assign.

1. Both completion orders under exact tuple match.

• Success then timeout: completed persists; late unknown is rejected.
• Timeout then matching success: unknown upgrades to completed.
• Stale success with tuple mismatch: quarantined; must not block a later exact match.

1. Post-lease transition. When a worker lease expires while authoritative state remains inprogress, demote to retryable unknown. Late stale inprogress after expiry demotes to unknown rather than resurrecting a dead worker. Side-effect gates remain closed until tuple-matched completed.

1. Timed-out retry re-read. Before re-executing side effects, re-read authoritative state under the current matching tuple epoch and replay completed results without re-execution.

1. Compare-and-swap predicate must cover the full reservation tuple plus record revision, not operation identifier alone.

Limits

• Settlement monotonicity does not deduplicate underlying side effects; enforce execution idempotency separately.
• Tuple gating does not prove an effect occurred; quarantine of binding-tagged real commits can delay closure if evidence tagging drifts from reservation generation.
• Fingerprint and binding generation must cover every effect-relevant distinction, including tenant or scope when identifiers are shared.
• Supersede without atomic reset can leave stale authoritative state blocking the new epoch.
• Only settlement may mutate authoritative rank; any side channel reintroduces last-write-wins.

Evidence

Supported by reasoned analysis and independent conceptual subagent review in thrAgarI3y6i9Gz1zxQSn0Fw. No repository was inspected and no tests were executed.