Monotonic settlement for optional publication retries

Trigger

Use when an optional background path can publish a remote side effect, the primary task must complete independently, and worker crashes, deadlines, or lost acknowledgements can trigger retries.

Failure it prevents

Prevents: declaring a possibly committed publication denied; duplicating publication with a fresh retry; allowing a late timeout to erase confirmed completion; adopting a successful response from the wrong request generation or authorization binding; same-rank terminal payload divergence freezing wrong result; and turning auxiliary warning floods into a new failure of the primary task.

Reservation tuple

Bind one durable operation identity to a reservation tuple:

• operation identifier
• request fingerprint
• authorization binding
• generation (bumped on edit or re-authorization)

Every retry reuses the same tuple for one logical publication. Edits or re-authorization bump generation and mint a fresh reservation.

Generation bump invariant

When generation advances, atomically reset terminal and frozen result fields and promote aggregate to pending or running for the new tuple. Prior-generation terminals are foreign evidence even if rank fields were not updated separately. Stale in-flight workers must not leave the aggregate showing completed for superseded intent.

Locked settlement

Apply in order within one atomic compare-and-set transaction:

1. Rank gate: reject strictly weaker terminals against current aggregate.
2. Reservation gate: terminal evidence must match the full current tuple; else quarantine.
3. Promotion: accept strictly stronger rank with matching tuple; freeze result.
4. Sameness gate: same terminal rank requires result equivalence; divergent payloads enter explicit conflict, never silent ignore.

Operation identifier match without fingerprint or binding match is foreign evidence.

Conflict state

Conflict is a terminal-equivalent rank that blocks further automatic promotion. Exit only via explicit resolution: human decision, new generation mint, or scoped retry authorized by resolver. Neither late failed nor late completed may overwrite conflict without defined exit.

Why success-blind merge is unsafe

Preferring any successful response ignores stale generation replay, cross-binding bleed after scope revocation, and foreign sibling confusion from misconfigured identifier pooling.

Reconciliation and unknown

Post-send silence yields unknown, not rollback proof. Before re-executing any side effect, re-read durable record and scope retry per effect class: do not redo a completed primary; retry auxiliary publication only when evidence permits. Unknown does not imply safe to redo; worker and integration layers must carry idempotency keys.

Quarantine visibility

Quarantined foreign or stale-generation terminals must be durably recorded and surfaced for reconciliation. Write-only quarantine without alerting can produce false failure when real success finished under superseded intent.

Primary path independence

Persist and return primary result without waiting for auxiliary publication settlement. Initialize sharing to deny before remote write. Worker crash before write leaves sharing denied, not primary failure.

Bounded warning cardinality

One durable row per primary task and warning class via unique constraint or idempotent upsert. Bounded warning class taxonomy required; unbounded class strings reintroduce cardinality growth.

Limits

Settlement makes the ledger safe; it cannot alone prevent duplicate remote effects without participating idempotency. Fingerprint canonicality must be stable across serializations. Re-authorization without generation bump must be impossible by schema or policy.

Evidence

Reasoned analysis refined by independent subagent review. No tests executed, no code run, no repository or configuration inspected.