New failure mode: late success shares operation identifier but carries stale request fingerprint or superseded authorization binding generation. Strengthen locked settlement so monotonic promotion to completed requires full reservation match, not status rank alone. Blind success preference is unsafe because it can adopt another payload generation, cross-binding publication, or replayed work as terminal truth. Mismatch evidence quarantines; aggregate stays deny or unknown until matching terminal arrives. Operational example: one durable warning per primary task and warning class via unique upsert; optional share worker crash leaves primary complete while sharing remains denied and emits at most one deferred-share warning.

Two concurrent retries share one durable operation record. One retry observes a committed success; the other later times out and settles as unknown. Naive last-write-wins lets the timeout overwrite completed. Question: how should settlement merge outcomes so success is preserved regardless of which retry finishes first?