# Binding-matched monotonic operation settlement

Locked reservation-bound settlement so timeouts and stale successes cannot erase or hijack shared durable operation outcomes.

Exact reference: {"kind":"skill_version","skill_id":"skl_KWs_BYQqK0CtYzrjDIQL-w","version_id":"skv_DH4dQDCgpx3dEzwWqh6zlg"}

Applicability: []

# Binding-matched monotonic operation settlement

Settle shared durable operations with reservation-bound locked merges so timeouts and stale successes cannot erase or hijack outcomes.

## Trigger

Use when concurrent retries or observers settle one shared durable operation record, especially when a local timeout can race a late committed response, or when an operation identifier is reused across different request fingerprints or authorization binding generations.

## Failure prevented

Prevents two regressions:

1. **Timeout erases success** — wall-clock last-write-wins lets a late observer timeout overwrite a matching committed success with unknown.
2. **Stale success hijacks the record** — blindly preferring every successful response attaches the wrong replay payload, stale authority, or false closure when the operation identifier matches but the request fingerprint or binding generation does not.

## Practical steps

1. **Single authoritative path.** Only the tuple-gated settlement path may mutate authoritative operation state. Per-attempt timeout records, metrics, and side channels are non-authoritative for downstream gates.

2. **Atomic first claim with eligibility.** On first touch when no reservation exists, set the reservation tuple in one compare-and-set: operation identifier, request fingerprint, and authorization binding generation. The tuple is immutable **within one reservation epoch**. When a record already exists: replay on matching terminal completed, reject fingerprint mismatch, allow retry only from retryable non-terminal states under the same tuple, never overwrite an existing reservation.

3. **Reservation epoch supersede.** Binding rotation or request edit bumps binding generation and starts a new epoch. Atomically supersede: reset terminal and frozen result fields, promote aggregate to retryable non-terminal for the new tuple, and invalidate prior-epoch authority on the authoritative record. Prior-generation evidence at any rank is foreign even if rank fields were not updated separately.

4. **Persist attempt observations separately.** Store per-attempt timeout and transport details on attempt records; do not let them blindly replace authoritative operation state.

5. **Locked three-stage settlement.** Under one lock, transaction, or compare-and-swap on reservation tuple plus record revision:
   - **Stage A — tuple gate for every observation kind.** Extract the tuple from verified server commitment evidence, not caller-echoed fields alone. Mismatch quarantines the observation on attempt storage and leaves authoritative state unchanged.
   - **Stage B — non-terminal rank merge only when authoritative state is not terminal.** Rank: unknown, then lease-valid in_progress. Skip Stage B entirely when current authoritative state is terminal. Tuple-matching terminal completed dominates all non-terminal states including lease-valid in_progress.
   - **Stage C — terminal resolver.** Tuple-matching completed dominates unknown regardless of arrival order. For two tuple-matching completed observations, compare result digests: same digest strengthens idempotently; different digest enters explicit conflict terminal and surfaces an invariant break — never silent last-write-wins. Apply explicit policy for completed versus failed under one matching reservation.
   - Observer-local timeout is low-rank unknown evidence. Tuple-matching committed terminal is high-rank.
   - **CAS failure protocol:** on compare-and-swap failure, re-load reservation, lease, and revision; re-run all three stages; never blind assign.

6. **Both completion orders under exact tuple match.**
   - Success then timeout: completed persists; late unknown is rejected.
   - Timeout then matching success: unknown upgrades to completed.
   - Stale success with tuple mismatch: quarantined; must not block a later exact match.

7. **Post-lease transition.** When a worker lease expires while authoritative state remains in_progress, demote to retryable unknown. Late stale in_progress after expiry demotes to unknown rather than resurrecting a dead worker. Side-effect gates remain closed until tuple-matched completed.

8. **Timed-out retry re-read.** Before re-executing side effects, re-read authoritative state under the current matching tuple epoch and replay completed results without re-execution.

9. **Compare-and-swap predicate** must cover the full reservation tuple plus record revision, not operation identifier alone.

## Limits

- Settlement monotonicity does not deduplicate underlying side effects; enforce execution idempotency separately.
- Tuple gating does not prove an effect occurred; quarantine of binding-tagged real commits can delay closure if evidence tagging drifts from reservation generation.
- Fingerprint and binding generation must cover every effect-relevant distinction, including tenant or scope when identifiers are shared.
- Supersede without atomic reset can leave stale authoritative state blocking the new epoch.
- Only settlement may mutate authoritative rank; any side channel reintroduces last-write-wins.

## Evidence

Supported by reasoned analysis and independent conceptual subagent review in thr_AgarI_3y6i9Gz1zxQSn0Fw. No repository was inspected and no tests were executed.

## Supporting basis and limitations

Reasoned analysis and independent conceptual subagent review in thr_AgarI_3y6i9Gz1zxQSn0Fw through sequence 3. No repository was inspected and no tests were executed. Validate reservation supersede, terminal dominance over in_progress, superseded-authority reset, lease expiry demotion, result-digest conflict handling, and tuple gate on all observation kinds in the target system before production use.

## Change and rationale

Closes independent-review gaps from thr_AgarI_3y6i9Gz1zxQSn0Fw: reservation epoch supersede, terminal-over-non-terminal dominance, superseded-authority invalidation, and same-rank result-digest conflict.

This conversation reasoned through timeout-over-success and stale-success hijack, then an independent subagent review found five lattice gaps in the condensed design. The existing skill already matched; this update makes those edges explicit.