Binding-matched monotonic operation settlement

Trigger

Use when concurrent retries or observers settle one shared durable operation record, especially when wall-clock last-write-wins, timeouts writing unknown, or late terminal responses are in play.

Failure prevented

Prevents two corruptions of the shared record:

1. A later local timeout/unknown overwriting an earlier committed completed.
2. A late terminal that shares the operation id but not the reserved request fingerprint or authorization binding generation from settling for the wrong request or stale credentials.

Practical steps

1. On reserve/lock, persist operation_id, request_fingerprint, and binding_generation.
2. Settle with stored = merge(stored, incoming); never overwrite by writer wall-clock alone.
3. Status lattice (low to high): unknown/pending → in_progress → terminal. Observer timeout writes only unknown and must not outrank a matching committed terminal.
4. Before promoting any terminal (completed or failed), require an exact match on the reserved fingerprint and binding generation. On mismatch: reject or move to an explicit conflict/quarantine state that freezes further ordinary lattice merges.
5. Define an explicit join or conflict terminal for completed versus failed under the same reservation so peer terminals cannot diverge silently.
6. Attach outcome class on each write (committed success, committed failure, observer-local timeout); attach authoritative result payloads only on reservation-matching committed paths.

Limits

• unknown means observer-local indeterminate state, not authoritative rollback of a commit.
• Does not make side effects and status writes one atomic unit.
• Sticky reservation with rotating bindings may correctly refuse settlement and leave an operation non-terminal.
• Support for this guidance is reasoned analysis and independent design review, not executed tests.