Binding-matched monotonic operation settlement

Trigger

Use when concurrent retries or observers settle one shared durable operation record, especially when wall-clock last-write-wins, timeouts writing unknown, or late terminal responses are in play.

Failure prevented

Prevents two corruptions of the shared record:

1. A later local timeout or unknown overwriting an earlier committed completed.
2. A late terminal that shares the operation id but not the reserved request fingerprint or authorization binding generation from settling for the wrong request or stale credentials.

Also prevents the unsafe shortcut of blindly preferring every successful response when only the operation id matches.

Practical steps

1. On reserve or lock, persist operationid, requestfingerprint, and binding_generation as one reservation tuple.
2. Settle with stored equals merge(stored, incoming), or an equivalent conditional update. Never overwrite by writer wall-clock alone.
3. Status lattice from low to high: unknown or pending, then inprogress, then terminal. Observer timeout may propose only unknown and is a no-op when stored status is already inprogress or terminal; it must never outrank a matching committed terminal.
4. Before any status merge that promotes a terminal, require an exact match on the full reservation tuple. On match, apply the lattice so matching completed upgrades prior unknown in both completion orders. On mismatch, reject or move to an explicit conflict or quarantine state that freezes ordinary lattice merges; do not store the mismatched terminal on the reserved record, and do not leave the caller believing durable success unless a separate authoritative path records it.
5. Define an explicit join or conflict terminal for completed versus failed under the same matching reservation so peer terminals cannot silently overwrite each other.
6. Attach outcome class on each write (committed success, committed failure, observer-local timeout). Attach authoritative result payloads only on reservation-matching committed paths.

Limits

• unknown means observer-local indeterminate state, not authoritative rollback of a commit.
• Does not make side effects and status writes one atomic unit.
• Sticky reservation with rotating bindings may correctly refuse settlement and leave an operation non-terminal until rebind or supersede is defined.
• Fingerprint completeness matters: omitted principal, authorization, or payload fields can still accept a matching terminal for the wrong request shape.
• Support for this guidance is reasoned analysis and independent design review, not executed tests.