ADR 031 Server-Authoritative Customer Reservation Creation

Context

The legacy customer flow gathers mother and emergency-contact details, multiple addresses, delivery and baby facts, service type and dates, options, caregiver preferences, and payment preparation before rendering one server-built final confirmation. Source anchors include source-refs/sanmopia_web/application/views/service/reservation_check_data.php:1-340 and source-refs/sanmopia_web/application/views/service/reservation_payment.php:42-145.

The modern conversational UI reveals one card at a time and supports editing completed answers. Its first server-draft binding now persists only an opaque draft identifier in browser session storage, reloads server state, and renders a server final-review projection. Typed production HTTP routes, authenticated mother resolution, and the durable Supabase adapter are now composed in the backend. Projection-backed production option-catalog and final-review authority adapters are also composed. That code is still partial implementation evidence, not runtime parity: selected regional-support quote amounts now resolve from pricing authority, but accepted booking impact and legal-acceptance authorities, a clean full-schema PostgreSQL replay, and canonical stage proof remain open.

The migration ledger already fixes the target lineage in SFC-20260708-CUR-082: CustomerReservationCreationCommand, ReservationDraftStepAuthorityProjection, ReservationDraftSupersessionPolicy, ReservationCreationPaymentHandoff, ReservationServiceOfferingAvailabilityPolicy, ReservationCreationChargeSnapshotHandoff, and CaregiverRecommendationSelectionIntent. This decision reuses those names and does not establish a parallel booking-intake vocabulary.

ADR-028 defines the split between an authenticated mother submitter and a branch operational actor. It does not decide how a browser draft becomes a reviewed booking command. This decision defines that narrower intake boundary without superseding ADR-028. Accepted ADR-012, ADR-018, ADR-020, ADR-021, and ADR-024 remain authoritative within their declared scopes.

Decision

Mother self-booking uses three server-owned stages: a revisioned reservation draft, a final_review ReservationDraftStepAuthorityProjection, and one idempotent CustomerReservationCreationCommand. The browser owns conversational disclosure and preference entry. It does not own the facts that authorize, price, match, contract, or persist a reservation outcome.

Revisioned intake draft

The customer reservation draft is the durable server-side record of normalized mother preference intent. The server creates its identifier, authenticated owner, revision, expiry, source catalog revisions, validation results, and downstream invalidation set. Every draft mutation supplies the expected draft revision and an idempotency key. A stale write fails without overwriting a newer answer. ReservationDraftSupersessionPolicy decides which quote, option, rental, calendar, candidate, and review facts become stale after an edit.

Preference intent may include reservation-time contact details, service addresses, desired service kind and dates, weekend or holiday preferences, caregiver preference answers, named-caregiver request text, payment-method preference, and requests to use sponsorship or delegated payment. These values request an outcome; none proves that the outcome is available or permitted. Care-history visibility is not reservation input: its separate read projection and authorization remain governed by ADR-024.

The bearer principal and backend-owned records derive all authority fields:

Browser may express	Server must derive
Contact and address intent	authenticated mother and member profile
Desired service and schedule	canonical branch, coverage, `ReservationServiceOfferingAvailabilityPolicy` result, service plan, calendar, and policy revisions
Caregiver preference or named-caregiver request	`CaregiverRecommendationSelectionIntent`, eligible candidate decision, explanation, and decision revision
Support, coupon, or payment preference	quote, support, discount, obligation, eligible methods, and amount
Sponsor, payer, or visibility request	membership, grants, capabilities, permissions, and current revisions
Confirm action	contract version, review fingerprint, booking state, and immutable acceptance facts

Client-supplied mother, member, branch, membership, candidate, quote, amount, contract version, permission, role, grant revision, status, or workflow state is neither accepted as authority nor copied into authoritative draft fields.

Final-review projection

ReservationDraftStepAuthorityProjection with step final_review is a query result for one exact draft revision. It resolves current backend facts through owned ports and returns:

projection id, projection revision, source draft revision, expiry, and confirmation readiness;
mother and reservation-party display snapshot;
canonical branch and frozen service-area decision;
eligible service plan, calendar occurrences, and policy revisions;
backend-resolved caregiver candidate decision and explanation from the CaregiverRecommendationSelectionIntent;
quote lines, support and discount decisions, customer share, ReservationCreationChargeSnapshotHandoff, payment preparation, and pricing revisions;
current service-contract version and content digest;
applicable sponsorship and payment-delegation capability results; and
missing facts, disabled reasons, and downstream sections invalidated by an earlier edit.

Care-history capability or event data is not folded into this final-review projection. A separate ADR-024 projection may be linked by the UI without becoming reservation draft input or confirmation authority.

The query mutates nothing. Frontend renders returned labels, amounts, reasons, and readiness unchanged. Editing an earlier preference advances the draft revision and makes every projection based on the old revision unusable, even if the visible values appear unchanged.

Customer reservation creation command

The public CustomerReservationCreationCommand input is deliberately narrow; the contract repository owns the transport route. The server obtains draftId from the authenticated path parameter rather than duplicating it in the request body:

Authorization: Bearer <session>
Idempotency-Key: <opaque replay key>

POST /customer-reservation-drafts/<opaque-server-id>/confirm

{
  "expectedDraftRevision": 7,
  "reservationDraftStepAuthorityProjectionId": "opaque-review-id",
  "expectedReviewRevision": 3
}

Invoking the command expresses the mother’s intent to accept the exact reviewed reservation and server-resolved contract. Before mutation, the backend re-resolves the bearer principal, active mother profile, membership, branch and coverage, service plan and calendar, candidate decision, quote, contract version, grants, permissions, draft expiry, and both expected revisions. Browser values cannot substitute for any failed check.

One primary-data transaction compares the expected revisions and records the server-selected creation outcome, immutable reviewed-fact fingerprint, contract acceptance, command audit, and outbox facts. It also applies consultation, extension, pre-reservation, or full-reservation routing from server facts rather than browser status fields. External relationship or workflow effects begin from the committed outbox. Exact replay returns the original result. Reusing the key with different input, changing an authoritative dependency, or confirming a stale projection fails closed without a partial outcome.

When creation produces a payable reservation, it consumes the backend-owned ReservationCreationChargeSnapshotHandoff and creates ReservationCreationPaymentHandoff plus the obligation facts required by ADR-020. It does not perform provider payment, infer delegated-payer authority, or mark a payment completed.

Layer-first Placement and Boundaries

The smallest owning slice is:

domain/reservation_operations/features/customer_reservation_creation/
application/reservation_operations/features/customer_reservation_creation/commands/
application/reservation_operations/features/customer_reservation_creation/queries/
adapters/reservation_operations/features/customer_reservation_creation/
interfaces/reservation_operations/features/customer_reservation_creation/
orchestration/reservation_operations/features/customer_reservation_creation/

Both application subdirectories are earned: draft updates and confirmation mutate, while final review is a read-only projection. No global command/query directory, empty mirror directory, or cqrs/ wrapper is allowed.

Dependency direction follows accepted ADR-029: domain <- application <- adapters/interfaces <- orchestration. Reservation Operations consumes Member Management, Branch Operations, Service Calendar, Caregiver Assignment, and Pricing Settlement only through public contracts, consumer-owned ports, or named orchestration. Feature-to-feature deep imports are forbidden.

Contract repository owns public OpenAPI, schemas, errors, and generated clients for draft, review, and customer reservation creation.
Backend owns normalization, revisions, validation, authorization, projections, persistence, acceptance, idempotency, audit, and outbox behavior.
Frontend owns the single-chat card timeline, local disclosure/focus, preference input, returned projection rendering, and safe conflict recovery.
Assembly owns ADR lineage, legacy field map, four-repository pins, integrated scenarios, cleanup, and redaction-reviewed WebP evidence.
Family-sponsored preparation and mother acceptance remain governed by ADR-021; this mother self-booking command cannot bypass that flow.

Required Implementation Evidence

implementation is partial because pinned contract, domain, authorization, and frontend code now exists. It cannot become implemented until evidence proves:

generated contracts reject client authority fields and expose preference intent separately from server projection fields;
draft create/update/reload and discard-by-supersession pass ownership, expiry, exact replay, conflicting replay, and stale-revision tests;
final review binds every retained legacy intake field or links an accepted de-scope decision, and earlier edits invalidate all dependent facts;
creation rejects forged mother, branch, membership, candidate, quote, contract, permission, and revision input rather than trusting it;
exact creation replay returns one outcome, while stale draft, stale review, changed policy/catalog, and reused-key conflicts leave no partial reservation or external side effect;
payment starts only from the resulting backend obligation under ADR-020;
desktop and mobile authenticated mother scenarios cover success, validation, edit/reprojection, conflict/retry, session expiry, and cleanup with zero browser console or network errors; and
the canonical visual-evidence registry records immutable frontend, contract, backend, and assembly revisions plus WebP hashes and redaction review.

Current Partial Evidence

Canonical P04 integration pins: backend c6eb6f2c467c4ca1d3fd1855d2abc11b74e4416b, contract 132e1a4e1077770247a17397efffceeb0699c045, frontend ffacc93939528f0e21d098d8fdf41bef3f978f07.
Actual owner desktop/mobile Chromium reached Astro → FastAPI → PostgREST → private Storage, consumed the bounded signature once, confirmed atomically, replayed exactly, exercised 422/409/403/401, and cleaned test state.
Integrated manifest records 56 public files, 53 visual assets, zero unexpected browser errors, and privacy review.
Evidence used a synthetic_test_only contract publication. Implementation remains partial; it is not production legal authority.

Detailed historical pins and former gaps remain in the ADR-031 implementation history ledger. Current phase truth is the Actor A-Z workflow SSOT.

Known Gaps

Product/legal owners must publish exact wording, item codes, signature duty and mechanism, retention policy, and immutable production revision under ADR-032.
The mother must confirm that exact production revision through the same real actor path.
Clean four-repository pins, deployment identity, and retained runtime/cleanup evidence must bind the production run.
P05–P13 remain separate sequential actor phases; their technical readiness cannot upgrade P04.

Consequences

The frontend can remain playful and editable without becoming a second booking engine. A changed branch, candidate, quote, contract, grant, or permission forces reprojection instead of silently confirming stale facts. More backend queries and conflicts become visible, but every confirmed booking has one explainable principal, reviewed fact set, revision lineage, acceptance, and replay identity.

Acceptance authorizes this target boundary but proves no implementation. Every repository change must still satisfy the required evidence and preserve the accepted authority of ADR-020, ADR-021, ADR-024, ADR-028, and ADR-029.

Revision History

2026-07-13: proposed server-authoritative mother reservation draft, ReservationDraftStepAuthorityProjection, and idempotent CustomerReservationCreationCommand boundary from the legacy binding audit and SFC-20260708-CUR-082. No implementation authority granted.
2026-07-13: accepted by the workspace owner. Implementation was not-started at acceptance time; acceptance did not claim contract, backend, runtime, or visual evidence.
2026-07-13: aligned the accepted boundary with ADR-024 by keeping care-history visibility outside reservation input, added the exact final-review projection identifier to the confirmation example, and named supersession as discard.
2026-07-13: aligned the confirmation example with the public route contract by deriving draftId from the authenticated path parameter instead of accepting a duplicate body field.
2026-07-13: advanced implementation to partial after pinning the corrected contract, layer-first backend foundation, table/progress authorization hardening, and initial server-draft frontend binding. Runtime, persistence, legal acceptance, and canonical visual evidence remain open.
2026-07-14: pinned the installable generated Python contract and FastAPI composition for all five draft routes. Authenticated mother resolution and Supabase persistence are wired; option-catalog and final-review authorities remain fail-closed, and clean PostgreSQL plus canonical stage evidence remain open.
2026-07-14: replaced unavailable authority placeholders with exact, projection-backed Supabase catalog and final-review adapters at backend 558510d; retained partial because owning-context materializers, atomic payable handoff, full migration replay, legal acceptance, and stage evidence remain open.
2026-07-14: recorded the first source-owned catalog contribution at backend 1200f42 without weakening exact-26 consumption. ADR-031 remains partial: trusted publication orchestration, 25 catalog producers, exact-26 and final-review materializers, atomic payable handoff, full migration replay, legal acceptance, and stage evidence remain open.
2026-07-14: preserved revisioned catalog authority, aligned snapshot-table privileges with the SSOT, widened contribution locking to the whole scope, and retained a database-first rollout wrapper at backend 83ac5b8. This is a materializer prerequisite only; exact-26 CAS, contribution-set freshness, remaining producers, and every previously listed completion gate stay open.
2026-07-14: added the exact-revision voucher-plan authority and the service_schedule.voucher_service_days producer boundary at backend 2c744fb. ADR-031 remains partial: trusted population/invocation, 24 producers, exact-26 materialization, final-review materialization, payable handoff, clean replay, legal acceptance, and canonical stage evidence remain open.
2026-07-14: completed voucher source freezing, atomic all-revision population, and committed-population exact selection at backend c1937ed. ADR-031 remains partial: approved source completion and trusted draft invocation, 24 producers, exact-26 materialization, final-review materialization, payable handoff, clean full-history replay, legal acceptance, and canonical stage evidence remain open.
2026-07-14: bound committed voucher selection to server-owned canonical criteria at backend b44fd49; callers can no longer nominate batch, revision, or version keys. ADR-031 remains partial because approved source completion, safe draft prepare/materialization, remaining producers, and every previously listed completion gate remain open.
2026-07-14: added the HQ-authorized, DB-stamped approved completion and population caller at backend 7a9d26e. ADR-031 remains partial: no actual source approval/invocation occurred, and canonical resolver, draft prepare, 24 producers, exact-26/final-review materialization, payable handoff, clean replay, legal acceptance, and stage evidence remain open.
2026-07-15: pinned backend 20a79e3 exact-26 materialization evidence: the application handler, Supabase current-set source and CAS sink, runtime composition, frozen ordered lineage, current-set-gated loader, RPC-only table ACL, and rollback-scoped isolated PostgreSQL smoke now exist. ADR-031 remains partial because no trusted draft trigger invokes that path, 24 producers and final-review materializers are absent, no real approved source has populated a complete set, and payable, clean replay, legal, stage, and browser-success gates remain open.
2026-07-15: pinned backend 863158c catalog-preparation projection, deterministic offering override precedence, dormant two-producer preparation, and disposable PostgreSQL replay/renewal/ACL/fail-closed evidence. ADR-031 remains partial: the 17-axis payload has no source-owned resolver or caller, 24 producers and projection refresh are absent, activation surfaces remain intentionally zero, and final-review, payable, clean-replay, legal, stage, browser, and actor A-Z gates remain open.
2026-07-15: pinned backend 406d565 smoke cleanup and 59d29eb v2 source-lineage binding, truthful legacy semantic separation, database-owned Asia/Seoul clock, and preparation-lineage-required offering publication. ADR-031 remains partial: concrete source adapters are 0/5, record-handler runtime wiring is 0, runtime E2E axes are 0/17, activation surfaces are 0, and booking has not yet rehydrated the authoritative projection.
2026-07-17: pinned backend 3d5f3cb actual local GoTrue/PostgREST four-role P04 acceptance, typed 422/409, exact replay, ten-step revision 1 -> 11, cleanup residue zero, and a fresh 12/26 production publisher registry. The exact-26 run fixture is test-owned and production final review remains 503; ADR-031 stays partial pending 14 publishers, automatic snapshot refresh, final-review materialization, atomic booking/payment handoff, actual Chromium and canonical WebP/four-repository evidence.
2026-07-17: pinned backend 20c74e60 layer-first Member Management family authority query/adapter plus two orchestration publishers. Fresh production registry is 14/26; a five-actor local run proves two opaque selectable references backed by raw authority lineage, 496 reservation/family tests, exact/external architecture checks, and cleanup 0/0/0. ADR-031 stays partial pending 12 publishers, automatic refresh, final-review success, atomic booking/payment handoff, actual Chromium, and canonical WebP.
2026-07-17: pinned backend 8e5465cc Layer-first continuation-source query/command, Supabase lineage adapter, and production publisher. Fresh registry is 15/26; a five-actor local run proves one opaque extension selection plus two family selections, 520 reservation/action/family tests, exact/external architecture checks, and cleanup 0/0/0/0. ADR-031 stays partial pending 11 publishers, automatic refresh, final-review success, atomic booking/payment handoff, actual Chromium, and canonical WebP.
2026-07-17: pinned backend 2882ae00 approved voucher income-type query/RPC/adapter/orchestration publisher. Supabase CLI migration registers 16/26; rollback-scoped approved-population smoke proves source order, consume_type_a_ga_1 → A-가-1형, missing-axis fail-closed, and zero residue. Functional regression is 6,727 passed; final architecture and changed targets are 16 and 29 passed. ADR-031 stays partial pending 10 publishers, automatic refresh, final-review success, atomic booking/payment handoff, actual Chromium, and canonical WebP.
2026-07-17: pinned backend 1fd9cdda owner-scoped promotion-entitlement query/RPC/adapter/orchestration publisher and trusted preparation binding. Supabase CLI migration registers 17/26; rollback-scoped PostgreSQL smoke proves owner isolation, proven-empty catalogs, opaque browser references, internal raw authority lineage, and frozen-authority revocation after redemption/revision change. Functional regression is 6,737 passed; the relevant subtree is 72 passed, with Ruff, Tach exact/external, and Vulture confidence-100 passing. ADR-031 stays partial pending 9 publishers, automatic refresh completion, final-review success, atomic booking/payment handoff, actual Chromium, and canonical WebP.
2026-07-17: pinned backend 293fe13d private-care workbook anti-corruption parser and source proof. The exact source workbook parses 20/20 rows with zero issues; stable tier/work codes, amount roles/bases, explicit five-days-per-week conversion, deletion markers, and multiple-birth derivation are now one tested SSOT instead of PHP database ids and mutable update branches. Registry stays 17/26; ADR-031 stays partial pending durable private-care approval, 9 publishers, automatic refresh, final-review success, atomic booking/payment handoff, actual Chromium, and canonical WebP.
2026-07-17: pinned backend f1868789 private-care exact-batch publication authority and duration/work/service-option projection. Supabase CLI migration registers 20/26; representative two-entry PostgreSQL smoke proves DB-owned time/fingerprint, exact replay, immutable published rows, and rollback residue zero. Full regression is 6,750 passed; focused target is 121 passed; DB lint, Ruff, Tach exact/external, and Vulture confidence-100 pass. ADR-031 stays partial pending actual 20-row source publication, 6 publishers, automatic refresh, final-review success, atomic booking/payment handoff, actual Chromium, and canonical WebP.
2026-07-17: pinned backend f71170ef voucher delivery-rank/workforce publication and cd57234f workbook column correction. The production publisher registry is 21/26; the guarded approved-population RPC and trusted preparation composition preserve stable source order and exclude legacy numeric ids. The actual pinned voucher workbook parses 198/198 entries with issue 0 after replacing positional P:W drift with a named B:X column contract and deletion-marker policy. Full regression is 6,768 passed; DB smoke/lint, Ruff, Tach exact/external, and Vulture confidence-100 pass. ADR-031 stays partial pending 5 publishers, automatic refresh, final-review success, atomic booking/payment handoff, actual Chromium, and canonical WebP.
2026-07-17: pinned backend 816bc09f source-reviewed rental equipment publication. Five stable keys and one immutable revision replace live numeric ids and duplicated PHP UI/admin billing branches; the existing domain charge catalog is built from the same rows used for reservation presentation. Supabase CLI migration, service-role/immutability/fingerprint DB smoke, and rollback register 22/26. Full regression is 6,779 passed; DB lint, Ruff, Tach dependency/external, and changed-production Vulture confidence-100 pass. ADR-031 stays partial pending 4 publishers, automatic refresh, final-review success, atomic booking/payment handoff, actual Chromium, and canonical WebP.
2026-07-17: pinned backend d4b8e467 source-reviewed caregiver service priority publication. Three stable keys and one immutable revision replace the legacy 0/1/2 codes, repeated select markup, and sequential delete/insert persistence as public authority. One domain catalog owns ordered-unique validation and creates the existing matching preferences. Supabase CLI migration, service-role/immutability/fingerprint DB smoke, and rollback register 23/26. Full regression is 6,796 passed; DB lint error 0, Ruff, Tach dependency/external, and changed-production Vulture confidence-100 pass. ADR-031 stays partial pending 3 publishers, automatic refresh, final-review success, atomic booking/payment handoff, actual Chromium, and canonical WebP.
2026-07-17: pinned backend 87e63f27 source-reviewed caregiver personality publication. Twelve stable question.answer keys and one immutable revision replace public numeric ids, blind pair grouping, repeated PHP markup, and delete/reinsert persistence as catalog authority. One domain catalog owns the six-by-two shape, exactly-one-per-question validation, and existing matching input translation. Supabase CLI migration, service-role/immutability/fingerprint DB smoke, and rollback register 24/26. Full regression is 6,806 passed; DB lint error 0, Ruff, Tach dependency/external, and changed-production Vulture confidence-100 pass. ADR-031 stays partial pending 2 publishers, automatic refresh, final-review success, atomic booking/payment handoff, actual Chromium, and canonical WebP.
2026-07-18: pinned backend adeae516 source-reviewed regional-benefit support publication. The v4+ empty support catalog is explicit authority, not an absent implementation. 완주군 legacy branches remain source evidence but are normalized into region-code and price-version windows; stale 영등포구 removal branches do not become public options. Supabase CLI migration, service-role/immutability/fingerprint DB smoke, and rollback register 25/26. Full regression is 6,816 passed; DB lint error 0, Ruff, Tach dependency/external, and changed-production Vulture confidence-100 pass. ADR-031 stays partial pending 1 publisher, automatic refresh, final-review success, atomic booking/payment handoff, actual Chromium, and canonical WebP.
2026-07-18: pinned backend a325e02f source-reviewed caregiver recommendation catalog publication. The producer reads existing frozen recommendation sets and publishes opaque selection references; legacy raw manager ids remain internal-only authority lineage. Direct local PostgreSQL migration, exact-26 materializer smoke, catalog smoke, DB lint error 0, Ruff, Tach dependency/external, and changed-production Vulture confidence-100 pass. Full regression is 6,820 passed. ADR-031 stays partial pending automatic refresh, final-review success, atomic booking/payment handoff, actual Chromium, and canonical WebP.
2026-07-18: pinned backend a7dbc0e7 partial final-review projection materializer. Last writable PATCH records a contract-valid server projection through Supabase, but keeps confirmation_ready=false and missing booking / payment handoff reasons. Reservation-creation regression is 351 passed; full regression is 6,823 passed. ADR-031 stays partial.
2026-07-18: pinned backend 48a1c429 retained final-review draft facts. Partial final review now binds mother contact, address, service, option, caregiver-mode, and payment-method display facts from draft/catalog state, replacing placeholder values. It remains confirmation_ready=false; no booking/payment/browser/WebP pass is claimed. Reservation-creation regression is 351 passed; full regression is 6,823 passed. ADR-031 stays partial.
2026-07-18: pinned backend a759da44 retained final-review schedule occurrences. Partial final review now carries date-validated, deduplicated, sequenced requested service occurrences and a matching partial serviceEndOn. It remains confirmation_ready=false; calendar allocation, quote, booking, payment, browser, and WebP proof are still open. Reservation-creation regression is 351 passed; full regression is 6,823 passed. ADR-031 stays partial.
2026-07-18: pinned backend 70ea0ca3 branch coverage final-review binding. A feature-local branch query and orchestration bridge bind current preparation authority to the source branch profile and revisioned service-area policy. Resolved decisions retain lookup/match/veto/profile/address evidence and clear only the coverage missing/invalidation entries. Authority-absent drafts remain partial; plan/calendar/quote/legal/payment/booking and browser/WebP proof stay open. P04 plus branch regression is 442 passed; full regression is 6,829 passed. ADR-031 stays partial.
2026-07-18: pinned backend 98bf0283 authoritative service-calendar final-review binding. Branch policy now carries its calendar-profile key and raw policy-rule key across the orchestration boundary; current catalog serviceDayCount, effective profile revision, national/branch holidays, and the existing calendar domain produce billable occurrences and end date. Missing structured metadata/profile keeps the projection partial, while malformed authority fails closed. Plan/calendar missing entries clear only after successful resolution. Full regression is 6,835 passed; affected context regression is 192 passed. Quote, legal acceptance, payment, booking handoff, actor/browser/WebP, and deployment proof remain open, so ADR-031 stays partial.
2026-07-18: pinned backend a4c6ffbd authoritative price-quote binding. Voucher day options retain one exact published price entry; private duration and work-schedule options retain source-owned entry sets whose intersection selects the quote. The existing pricing domain and current effective Supabase publication remain the only amount authority. Missing or ambiguous lineage stays partial and malformed lineage fails closed. Full regression is 6,841 passed; focused regression is 24 passed. Legal acceptance, payment, charge/booking handoff, actor/browser/WebP, and deployment proof remain open, so ADR-031 stays partial.
2026-07-18: pinned backend 4166ddf1 pricing-owned reservation-creation charge-snapshot handoff. Stable draft/quote lineage now produces the exact amount and pricing revisions consumed by later confirmation, and final review clears that missing fact only with an authoritative quote. Full regression is 6,843 passed; focused regression is 11 passed. Atomic confirmation, obligation/payment handoff, legal acceptance, actor/browser/WebP, and deployment proof remain open, so ADR-031 stays partial.
2026-07-18: pinned backend 121f786c authoritative payment preparation. Current eligible payment methods and exact quote payable amount now produce server-owned preparation; unsupported selected methods fail closed. Full regression is 6,847 passed; focused regression is 13 passed. Provider payment, ADR-020 obligation/payment handoff, legal acceptance, actor/browser/WebP, and deployment proof remain open, so ADR-031 stays partial.
2026-07-18: pinned backend 8e7b88bf atomic payable obligation and handoff. The command and Supabase transaction freeze reviewed amount, method eligibility, charge lineage, and draft/review revisions into one waiting ADR-020 obligation while committing acceptance and outbox. Focused regression is 32 passed; full regression is 6,851 passed; the migration applied to the disposable P04 DB and lint returned no error. Finalized booking snapshot/materialization, clean replay, readiness, legal, actor/browser/WebP, and deployment proof remain open, so ADR-031 stays partial.
2026-07-18: pinned backend d29f6b7a frozen caregiver recommendation final-review binding. Exact decision/reference/revision and opaque selection close only the caregiver missing/invalidation; stale or malformed authority remains partial. Focused regression is 6 passed, full regression is 6,853 passed, and global readiness remains disabled.
2026-07-18: pinned backend 7a345e7b authoritative empty-support decision. Current support and promotion catalogs plus two truly empty request arrays clear only support invalidation. Selected support remains unresolved until pricing-owned amount and policy revision authority exists. Focused regression is 8 passed; full regression is 6,855 passed.
2026-07-18: pinned backend 867ba51f selected-promotion pricing authority. The server revalidates live owner entitlement revision, applies multiple coupons in catalog source order with a zero-payable floor, and propagates the adjusted amount through quote, charge handoff, payment preparation, and the waiting-obligation input. Selected regional support still fails closed without an owner amount rule. Full regression is 6,864 passed.
2026-07-18: pinned backend b7894b89 confirmation-outbox delivery adapter. Runtime now exposes typed claim/complete/fail over the existing attempt-CAS RPCs. Accepted-projection to booking-command translation and booking workflow execution remain open. Full regression is 6,868 passed.
2026-07-18: pinned backend 0676b50e versioned booking execution mapping. Stable reviewed selections plus exact price and service-day authority now resolve one internal legacy execution tuple. Missing or ambiguous lineage fails closed; reservation_amount_hint and browser labels are not authority. Persistence round-trip keeps the tuple outside the public final-review payload. Full regression is 6,876 passed; outbox consumption and booking execution remain open.
2026-07-18: pinned backend 60334ee0 and assembly 517cd210 working-time authority lineage. The internal mapping now also requires ISO local start/end times, an IANA timezone, and a working-time policy revision. Legacy evidence at sanmopia_web/application/views/about/terms.php:259-268 distinguishes commute, Saturday, and live-in windows and allows negotiated live-in changes; therefore runtime code does not infer hours from numeric working-type IDs. Missing or invalid time lineage fails closed. Full regression is 6,876 passed; the stage smoke seed carries stable selection, price, and time lineage but was not deployed or executed.
2026-07-18: pinned backend 384a97a69bb7ff53c6475946611d7da6dce78d4a caregiver execution selection. Caregiver Matching retains candidate_profile_id only inside its application result while published reservation options remain opaque. Final review re-resolves current owner/request/decision/revision and either explicit opaque selection or frozen rank one, then persists canonical positive legacy caregiver ID only in internal_booking_execution_mapping. Stale, unknown, ambiguous, or non-numeric execution identity remains partial. Full regression is 6,881 passed; Ruff, Tach exact/external, and changed-production Vulture confidence 100 pass. Outbox-to-command translation and booking workflow execution remain open.
2026-07-18: pinned backend 045c145b2cb41d93b29ce8a165bbc39e85c2d31c accepted booking handoff reader. A service-role-only RPC loads the exact confirmed final-review projection for one processing outbox attempt, because the active-draft final-review query is no longer valid after confirmation. It verifies outbox id, command, draft, booking request, attempt count, confirmation state, projection revision, and reviewed fingerprint before returning an immutable snapshot. The migration is committed but has not been applied to local, stage, or production Supabase.
2026-07-18: pinned backend d23b1842ae5f5533e73393c43b68ece894332544 accepted-reservation booking consumer. Named orchestration re-resolves the accepted branch, versioned service execution mapping, selected caregiver, timezone-aware working window, quote, payment eligibility, and coverage before creating the existing public booking command. A bearer-protected internal job claims pending rows, starts ReservationBookingWorkflow, accepts exact workflow replay, and settles the same outbox attempt through CAS complete/fail. Full regression is 6,900 passed; Ruff and Tach exact/external pass. Vulture confidence 100 reported only five existing Protocol parameter false positives and no new consumer finding. ADR-031 remains partial: ADR-032 legal acceptance still blocks a production-created accepted outbox, accepted service-term/offering side-effect assembly remains open, the new migration is unapplied, and no actor/browser/WebP/deployment run occurred.
2026-07-18: pinned backend be9ec4f9230309586ead4002ce7db34d5fb41724 accepted service-occurrence ledger binding. The handoff translator now requires accepted occurrence count to equal the quote service-day count, contiguous sequence numbers, strictly ordered in-range dates, exact calendar-profile and policy revisions, and a last occurrence matching the accepted end date. It creates the existing domain ServiceTermPlan, so the existing booking workflow persists its occurrence ledger instead of rebuilding dates from legacy numeric IDs. Focused regression is 25 passed; full regression is 6,902 passed; Ruff, Tach exact/external, and changed-file Vulture confidence 100 pass. This is local code/test evidence only. Accepted offering availability and consumer-impact side-effect assembly still need explicit accepted contracts; no Supabase migration, actor, browser, WebP, or deployment run occurred.
2026-07-18: pinned backend b1beee53fec1ca5d0a893841570246ec3f2c6cc3 durable accepted-booking delivery recovery. A service-role-only RPC requeues only the exact failed attempt or a processing attempt older than the server-owned 15-minute cutoff. It preserves attempt count for the next claim, appends the source status, claim time, error, reason, actor, and immutable delivery snapshot to a recovery audit, and returns the stored result for an exact idempotency-key replay. Advisory-lock serialization plus attempt/status compare-and-set prevents concurrent duplicate recoveries and newer-processing recovery. The bearer-protected internal route exposes safe 404/409/503 outcomes without leaking database details. Focused regression is 60 passed; full regression is 6,917 passed; Ruff, Tach exact/external, and changed-production Vulture confidence 100 pass. Migration 20260718124500 was applied verbatim to a disposable PostgreSQL 17.6 database with a scoped outbox contract and passed Supabase CLI schema lint with error 0; it was not applied to local stage or production, and this is not clean full-history replay evidence. ADR-031 remains partial: legal acceptance, finalized booking/readiness, actual actor/browser/WebP, and deployment proof remain open.
2026-07-18: pinned backend fcad4c50f9e07576773adc91548b159350ed275a accepted offering and consumer-impact assembly. The service-offering owner contribution now retains the full availability decision inside the catalog fingerprint. Final review accepts it only when the selected enabled option, full-reservation handoff, policy source revision, and source evidence agree, then stores it in the internal booking mapping without adding a fourteenth public review section. The accepted-handoff translator reconstructs the domain availability decision and uses one application-owned builder for daily-report, settlement, and service-calendar invalidation facts; the existing public booking API now reuses that same builder. Missing or drifting metadata stays a named missing fact or fails closed. Focused affected regression is 123 passed; full regression is 6,919 passed; Ruff and Tach exact/external pass. Vulture confidence 100 found no changed implementation candidate; its 15 reports are existing Protocol parameter false positives. No migration, Supabase actor E2E, browser, screenshot, WebP, or deployment ran for this slice. ADR-031 remains partial until legal acceptance, finalized-booking/readiness, clean replay, and canonical actor/browser evidence close.
2026-07-18: pinned backend 3ac941d59fb7fcfdb35fbf26a69baaeec20d1167 current-revision final-review catalog refresh. Terminal PATCH and exact replay now call an application port whose named orchestration verifies owner scope, prepares and materializes the exact 26 contributions for the persisted draft revision, reloads the owner-scoped provider, and passes only that fresh snapshot to final-review materialization. Cross-owner calls fail before writes; missing current preparation authority stays fail-closed and exact replay retries preparation. Focused regression is 21 passed, Tach-affected regression is 411 passed, full regression is 6,921 passed, and Ruff plus Tach dependency/interface/external gates pass. Vulture confidence 100 reports 13 existing Protocol parameter candidates and authorizes no deletion. The five preparation-authority source adapters and per-draft record activation remain open; no migration, actual Supabase actor E2E, browser/WebP, or deployment ran. ADR-031 remains partial.
2026-07-18: pinned backend 026a8ba4cd17eb87acd084be9017ee292e7ee8dc preparation reservation-state source. The existing owner source-state query and revisioned mapping policy now implement one of five preparation source ports. Current pre-reservation is derived from modern active lifecycle stages rather than raw legacy status or historical flags, and extension intent requires the owner’s exact opaque selection without exposing the internal reservation id. Runtime shares the same query handler with the extension catalog publisher. Focused regression is 11 passed, Tach-affected regression is 116 passed, full regression is 6,925 passed, Ruff and Tach dependency/interface/external pass, and Vulture confidence 100 reports no candidate. Source coverage is 1/5; the remaining four sources and record-authority activation stay open. No migration, actual Supabase actor E2E, browser/WebP, or deployment ran. ADR-031 remains partial.
2026-07-18: pinned backend dcced6ad461df0b9226a8b61dbebc80a412a31a5 preparation branch-coverage source. Branch Operations now lists only active core branches with an active office profile and a positive legacy compatibility id, excludes headquarters internal profiles, and evaluates each candidate through the existing revisioned service-area policy. Automatic selection succeeds only when exactly one candidate is available; zero matches, multiple matches, consultation-only, unavailable, malformed profile lineage, and ambiguous source ids fail closed. Customer address evidence is fingerprinted as customer_input; raw address text is not copied into preparation lineage. The source is composed in the Supabase runtime but the five-source record handler remains inactive. Focused regression is 10 passed, Tach-affected regression is 603 passed with 6,308 deselected, full regression is 6,932 passed, Ruff and Tach dependency/interface/exact/external pass, and changed-production Vulture confidence 100 reports no candidate. Source coverage is 2/5; service-offering policy, price version, voucher criteria, and record-authority activation remain open. No migration, actual Supabase actor E2E, browser/WebP, or deployment ran. ADR-031 remains partial.
2026-07-18: pinned backend 7af3496ba106e976f2e71ab64fbefa749c5a4e83 preparation service-offering policy source. The Service Offering Availability owner query now resolves the draft’s exact serviceOfferingKey against the effective catalog/branch/region row and requires one explicit source_reference.catalog_preparation_policy object. Service program, service-type detail code, policy revision, and the inclusive pre-reservation day threshold are database-owned metadata; the adapter does not infer them from labels, row order, or legacy numeric ids. Missing metadata, no match, duplicate match, stale validity, or selection drift fail closed. Lineage retains the source-row UUID, catalog version, policy revision, source-updated timestamp, evidence key, and a daily validity window. The concrete Supabase adapter is constructed in main and injected through the application port, so the orchestration slice does not add a direct adapter dependency. Targeted regression is 16 passed, Tach-affected regression is 254 passed with 6,668 deselected, full regression is 6,943 passed, Ruff and Tach dependency/interface/exact/external pass, and changed-production Vulture confidence 100 reports no candidate. Source coverage is 3/5; price version, voucher criteria, and record-authority activation remain open. Supabase CLI 2.109.1 is available through pnpm, but the local stack is not running; no migration, actual Supabase actor E2E, browser/WebP, or deployment ran. ADR-031 remains partial.
2026-07-18: pinned backend 0809dc2524b65ef5b26ae54a01d2433ad551a35a preparation price-catalog version source. Pricing Settlement now requires every new normalized import batch to carry the exact positive legacy LIST_PRICE_VERSION_TB.PRICE_VERSION_LIST_ID_PK identity as source_price_version_id; it is compatibility lineage, not an ordinal or a value derived from catalog label/year. A Supabase CLI-created migration adds the field and blocks publication when it is missing. The owner query accepts exactly one published effective batch containing the requested service program. Voucher batches must also resolve one unique published price_version_key; missing or conflicting keys, overlapping candidates, future publication timestamps, malformed lineage, and selection drift fail closed. The decision fingerprint freezes batch UUID, explicit source id, program, catalog/version, effective window, publication timestamp, database authoritative fingerprint, and source update timestamp. Focused regression is 50 passed, price/Supabase regression is 184 passed, Tach-affected regression is 731 passed with 6,205 deselected, and full regression is 6,957 passed; Ruff, Tach dependency/interface/exact/external, and changed-production Vulture confidence 100 pass. Source coverage is 4/5; voucher criteria and record-authority activation remain open. The local Supabase stack container is absent, so the migration has not been applied and no actual Supabase actor E2E, browser/WebP, or deployment ran. ADR-031 remains partial.
2026-07-18: pinned backend 68ce17dc50dbda2139d133120bff411701b91c78 preparation voucher-plan criteria source. The fifth source does not parse browser labels, prefixes, or legacy numbers. It first proves the selected baby-type option against the exact persisted birth.baby_types catalog revision and its source-backed quantity bounds. It then resolves the selected delivery/workforce and income option keys through the approved voucher population catalogs, requires both catalogs to share one source revision, population, price batch, price version, consume-type revision, and fingerprint, and loads the exact published voucher-plan revision selected by those canonical axes. Batch/version drift, an unknown or guessed option key, a conflicting baby count, ambiguous selection, incoherent publication payload, non-intersecting effective windows, and future publication fail closed. Lineage freezes the persisted baby catalog revision, exact browser option keys, approved population/source revision, price batch/version, canonical voucher axes, effective window, and both source and published-revision fingerprints. Focused pricing/reservation regression is 140 passed, full regression is 6,967 passed; Ruff, Tach dependency/interface/exact/external, and changed-production Vulture confidence 100 pass with zero candidates. Source composition is now 5/5. This is not record-authority activation: the current v2 persistence guard still couples the preparation evaluation date to the voucher quote date, so a desired future service-start quote cannot yet be recorded honestly. No SQL migration, actual Supabase actor E2E, browser/WebP, or deployment ran. ADR-031 remains partial.
2026-07-18: pinned backend 0934462df40116ed05d580140a639622f74f3fd9 activates catalog-preparation authority in the terminal PATCH and exact-replay path. V3 preserves the v2 17-field payload and five-source lineage contract, but separates the database-owned Asia/Seoul evaluation date from the voucher quote date. The former must equal the current database business date; the latter must equal the persisted service_schedule.desiredServiceStartOn. The record RPC also rechecks the persisted service-offering key and baby count/type before it stores the fingerprinted authority. Runtime now resolves all five sources, records that exact draft revision through the v3 RPC, then publishes and reloads the exact 26-catalog snapshot. A record failure stops publication and reload. Scoped PostgreSQL 17 verification applied v1, v2, and v3 in order, then recorded and loaded an authority with evaluation date 2026-07-18 and future quote date 2026-08-17; projection revision was 1 and the loaded fingerprint matched. Focused regression is 65 passed, reservation-creation regression is 425 passed, Tach-affected regression is 229 passed with 6,727 deselected, and full regression is 6,977 passed; Ruff, Tach dependency/interface/exact/external, and changed-production Vulture confidence 100 pass with zero candidates. Migration 20260718130000_customer_reservation_catalog_prepare_authority_v3.sql is repository-only: the local Supabase stack is absent, so no actual Supabase actor E2E, browser/WebP, or deployment ran. ADR-031 remains partial.
2026-07-18: pinned backend ba622266d018ff350bcaec44b7c7c3b400d5d86d freezes the customer-entered contact, birth/baby, and care-environment facts inside the fingerprinted internal accepted booking mapping. The snapshot resolves emergency relationship, delivery type, baby type/gender, older-child count, care-center term, and pet species/size through the exact current catalog options, preserves their display labels and catalog/authority revisions, and fails closed on disabled, missing, ambiguous, or quantity-incoherent selections. The accepted-handoff translator now reads pet facts only from this retained snapshot; later mutation of the current operational context cannot replace the care environment that the customer reviewed and accepted. At that pin, the then-13-section public final-review contract did not display all of these retained facts, so this is not completion of the retained-fact UI criterion. Focused integration is 23 passed, application reservation creation is 127 passed, orchestration reservation creation is 79 passed, relevant adapters are 23 passed, Tach-affected regression is 437 passed with 6,523 deselected, and full regression is 6,981 passed; Ruff, Tach dependency/interface/exact/external, and changed-production Vulture confidence 100 pass. Vulture’s three reports are existing required evaluated_at protocol parameters, not deletion candidates. This slice adds no migration and ran no actual Supabase actor E2E, browser/WebP, or deployment. ADR-031 and P04 remain partial/RED.
2026-07-18: contract 0f5f33324b3a4ee4bad1d40b9faa8d102c0bd5b1, backend 5be421944e279d1e5d916dfb6fe7732c7da732db, and frontend fb69309642e5a400a0b80e7e69df2e304a741493 close the public retained-intake display/edit gap without weakening the internal accepted authority. The exact-root final-review contract is now 14 sections and requires customerIntakeDisplaySnapshot. Its public shape contains birth date and emergency contact, birth/baby facts, and care-environment/pet facts with stable option keys and server-resolved labels; it rejects leaked catalogLineage, malformed baby sequence, and incoherent pet data. Backend projects this public-safe shape from the same frozen internal customerIntakeSnapshot with a defensive copy, while raw authority and catalog lineage remain internal. The Astro UI renders three responsive final-review cards and exposes edit actions inside those cards; editing returns to the selected chat step and obeys the server downstream invalidation set. Contract gates report 486 TypeScript and 82 Python tests; backend focused reservation-creation regression reports 430 passed, Tach affected reports 438 passed with 6,523 deselected, and the full backend reports 6,982 passed. Ruff and Tach dependency/interface/exact/external pass. Vulture’s 17 confidence-100 findings are required Protocol method parameters, not deletion candidates. Astro check, lint, production build, and 575 frontend tests pass. Real Chromium generated 39 local desktop/mobile PNG/WebP/JSON artifacts with sequential reveal, focus/scroll, retained display labels, final-review-local edit, downstream invalidation, 409, 200, and typed 422 assertions; its manifest remains status=provisional, runtimeEnvironment=local_astro_mocked_api, and completionClaim=false. No actual Supabase actor E2E or deployment ran, and selected regional-support amount plus legal/contract acceptance remain fail-closed. ADR-031 and P04 therefore remain partial/RED.
2026-07-18: backend b8b5d8ea2bb2edfe1057ec457ec142db090156ff reruns the whole retained-intake boundary through a disposable local Supabase DB, GoTrue, PostgREST, the production Supabase adapters, and the production FastAPI transport. Five actors prove unauthenticated 401, branch/caregiver create 403, foreign owner read 403, typed validation 422, stale revision 409, exact create and PATCH replay, all ten sequential steps, and final draft revision 11. The terminal PATCH records current preparation authority, invokes all 26 production publishers, exact-set materializes the catalogs, and records one 14-section final-review projection. GET final review returns 200 with confirmationReady=false; the public retained-intake payload leaks zero catalogLineage fields while its internal booking mapping retains eight catalog lineage entries. The explicitly test-owned source fixture does not fabricate missing branch calendar or legal authority. The unresolved facts remain branchServiceAreaDecision, eligibleServicePlan, eligibleServicePlan.serviceOfferingAvailabilityDecision, priceQuote, reservationCreationChargeSnapshotHandoff, paymentPreparation, and serviceContract.acceptance. Full Python regression is 6,986 passed; Tach-affected regression is 6,689 passed with 276 deselected; Tach dependency/interface/exact/external and Ruff pass; Supabase DB lint reports zero errors. Vulture confidence 100 reports only stale_processing_before, a verified required Protocol keyword implemented and consumed by the recovery path. No new browser screenshot/WebP or deployment ran. ADR-031 and P04 remain partial/RED.
2026-07-18: contract b487fafdfa01aa6971908426a9e43c5d2a90bce9, backend 6f8fe102057af62e84ba3729c712625b5bc3f138, and frontend 65c674df2511a1bd1b136e29859930857b8ffbb7 close the actual local browser-integration gap for the partial final-review boundary. The TypeScript validator now accepts priceQuote.lines=[] only when confirmationReadiness.ready=false and the missing fact path names priceQuote; ready projections still reject empty quote lines. Initial draft HTTP responses omit unset optional step inputs instead of serializing ten null values against the public Partial<StepInputMap> contract. Actual Chromium uses a GoTrue owner cookie, Astro same-origin proxy, production FastAPI routes, PostgREST, and the production Supabase adapter without route mocks. Desktop and 390px mobile each complete all ten cards, advance to revision 11, receive final review 200, render one readable warning column, and keep confirmation disabled. Exactly one current card is visible, focus/scroll follows each save, horizontal overflow is absent, and console warning/error, page error, failed request, and HTTP error counts are zero. Editing mother_contact advances revision 12, retains all ten customer input sections, invalidates eleven derived authority sections, and reloads the exact revision-12 review. This preserves input SSOT while refusing stale branch, plan, calendar, quote, payment, contract, or review authority. Frontend gates pass 576 tests, lint, Astro 7 check, and build; contract gates remain 486 TypeScript and 82 Python tests. The redaction-reviewed evidence pack is /evidence/mother-family-conversational-booking/p04-live-browser-65c674d/ with 31 public files, desktop/mobile animated WebP, readiness and edit screenshots, status=provisional, and completionClaim=false. Its source authority is explicitly test-owned, productionSourceCompletenessProof and deployment proof are false, selected regional-support amount and ADR-032 legal acceptance remain unavailable, and no online deployment ran. ADR-031 therefore remains implementation: partial; P04 remains RED.
2026-07-18: backend 665bf7e1be7b38648e15dd9e3daa09bbea4f546d and frontend b4f6d4680105dd5d0f8399fcaf781d3b21e51721 close the actual local browser validation/conflict-recovery evidence gap at the partial-review boundary. The stale PATCH path had loaded mutable catalog authority before comparing expectedRevision, so a temporarily unavailable catalog could turn an authoritative revision conflict into 503. One domain SSOT preflight now checks the current draft revision immediately after owner/draft load and before any mutable authority provider; patch and confirm reuse the same invariant. A regression provider that raises if called proves the stale path cannot regress to catalog loading. The affected backend domain, adapter, HTTP, and runtime gates report 75 passed; Ruff and dependency checks pass. The frontend now runs the actual Astro production build and preview behind a Node built-in same-origin reverse proxy, preserving production CSP while routing the browser’s reservation API paths to FastAPI. This removes the previous dev-module noise and does not bypass CSP. Actual Chromium proves: one deliberately schema-invalid outgoing PATCH receives the real FastAPI 422, renders deduplicated safe validation copy in the current applicant_authority card, and leaves persisted revision 1, completed count 0, and step inputs unchanged; a real external write advances another draft to revision 2, the stale browser PATCH receives 409, performs one explicit GET with no blind PATCH retry, then advances to revision 3 only after manual review/save. Focused frontend tests report 34 passed; lint, Astro check, and production build pass. The redaction-reviewed pack is /evidence/mother-family-conversational-booking/p04-live-browser-b4f6d46/ with 39 public files, 38 manifest assets, four animated WebPs (desktop/mobile success, desktop 422, mobile 409), verified hashes, and no raw token, idempotency key, disposable id, or real-person data. Its manifest keeps status=provisional, completionClaim=false, productionSourceCompletenessProof=false, confirmationReadinessProof=false, and deploymentProof=false. The 422 invalid input is synthetic at the outgoing browser-request boundary; the server response, UI behavior, and durable persistence result are actual. Selected regional-support amount, ADR-032 legal acceptance, confirmation-ready final confirm, production-source-complete rerun, clean four-repository pin, and deployment remain open. ADR-031 stays implementation: partial; P04 stays RED.
2026-07-19: frontend 9c506d2c640b3083a9d407d43a48391e8a3cf50e extends the same actual local browser boundary to non-mother create authorization. Branch operator and caregiver GoTrue sessions each send the real POST /customer-reservation-drafts through Astro production preview, the same-origin proxy, FastAPI, PostgREST, and Supabase. Both receive 403; no draft card is rendered; the UI exposes only the safe Korean authorization copy and no raw role, token, or authority value. The existing owner desktop/mobile ten-step, edit/reprojection, actual 422, and actual stale 409 cases were rerun on the same repository pins. The current pack is /evidence/mother-family-conversational-booking/p04-live-browser-9c506d2/ with 42 public files, 41 manifest assets, and five animated WebPs. The authorization WebP contains two labeled evidence frames so visually equivalent branch/caregiver denials are not collapsed by the encoder; the underlying screenshots remain unmodified browser captures. Manifest hashes, two 403 responses, zero draft cards, safe copy, and token/PII redaction all pass. Frontend full 91 files / 577 tests, evidence-runner lint, Astro check, and production build pass. completionClaim=false, confirmationReady=false, productionSourceCompletenessProof=false, and deploymentProof=false remain unchanged. ADR-032 legal facts, selected regional-support amount, confirmation-ready final confirm, clean four-repository pin, and deployment remain open. ADR-031 stays implementation: partial; P04 stays RED.
2026-07-19: frontend 43716602ec918217a5eb7171b2b19d5d59801de6 hardens the browser resume boundary. When an opaque owner draft key remains in session storage, an actual foreign-mother GoTrue session now sends the real owner-draft GET, receives 403, renders no draft card, displays only safe authorization copy, and removes the cross-session resume key. A second browser case starts with the valid owner session and deliberately removes Authorization from the resume GET after page initialization. The FastAPI response is actual 401; the UI renders the safe session-expiry copy and retry control, renders no draft card, and removes the resume key. This test-owned header mutation does not claim a wall-clock token-expiry transition. Store unit tests cover both 401 and 403 purge behavior without creating a duplicate draft. p04-live-browser-4371660 contains 45 public files, 44 manifest assets, and six animated WebPs. All asset hashes, raw-token/idempotency-key/PII redaction, actual response matrices, draft-card counts, and resume-key purge observations pass. Frontend full 91 files / 579 tests, evidence-runner lint, Astro check, and production build pass. completionClaim=false, confirmationReady=false, productionSourceCompletenessProof=false, and deploymentProof=false remain unchanged. ADR-032 legal facts, selected regional-support amount, wall-clock expiry, confirmation-ready final confirm, clean four-repository pin, and deployment remain open. ADR-031 stays implementation: partial; P04 stays RED.
2026-07-18: backend 8e37ab8aec13a2ee097e530f9ff232d34d992097 resolves selected regional-support quote amounts without copying KRW values into reservation option catalogs. The final-review resolver reloads the exact persisted preparation authority, maps the reviewed price program to the regional support contract code, and asks Pricing Settlement to revalidate the approved catalog fingerprint, rule count/order, effective and price-version windows, region, branch, and selected option keys. Fixed, rate, and component-based formulas consume only the backend price quote component map. Regional support is applied before owner-scoped promotion entitlement discounts, so promotions are capped against the remaining payable. Regional and promotion decision revisions are both frozen into the charge handoff fingerprint. Service-day, end-date, and own-price effects remain fail-closed, and support_decisions_resolved remains false for a selected regional benefit until the full accepted RegionalBenefitDecision reaches the booking command and downstream settlement/calendar consumers. The current v4+ production catalog remains a proven empty revision, so this commit adds no fabricated browser selection, screenshot, WebP, or deployment proof. Full regression is 7,033 passed; Tach affected is 125 passed with 6,887 deselected; Tach dependency/interface/external diagnostics, Ruff, and changed-production Vulture confidence 100 findings are all zero.
2026-07-18: backend 8b214509e8658df3eb6d2845f26e8b9d18c4d43a freezes the complete accepted regional-benefit line, component, policy, source, settlement, effect, and decision lineage in the internal final-review booking mapping. A reservation-booking application contract exact-validates the public support decision, accepted quote credit line, charge pricing revision, source options, and catalog revision without a cross-feature domain import, then reconstructs and passes the discount-only RegionalBenefitDecision to the booking command. Discount-only selections may now set support_decisions_resolved=true; non-zero service-day, end-date, or own-price effects remain fail-closed. Targeted contract/translator regression is 14 passed, full regression is 7,039 passed, Tach dependency/interface/exact/external diagnostics and Ruff are zero/pass. Vulture confidence 100 reports one operational_mother_member_id candidate; its Protocol implementation, forwarding, and call are live, so it is not deleted. The production v4+ catalog remains proven-empty, therefore no non-empty runtime/browser/WebP or deployment proof is claimed.
2026-07-18: backend 35f67ff912d32c92e4772e60895bf1da45014437 freezes the accepted direct mother’s mother/booker/payer roles and expected new-booking revision 1 beside booking/payment state through a trusted-only, append-only Supabase authority snapshot. Public HTTP cannot supply that binding. Actual database checks cover initial save, exact replay, authority drift 40001, stale expected-revision rollback across booking/payment/snapshot, immutable update 55000, and service-role-only ACL. The same backend pin and frontend 43716602ec918217a5eb7171b2b19d5d59801de6 were then rerun through disposable GoTrue/PostgREST/Supabase, production FastAPI, Astro production build/preview, and the same-origin browser proxy. p04-live-browser-35f67ff contains 45 public files, 44 manifest assets, and six animated WebPs. Desktop/mobile completed-step count 10, single-current-card, automatic focus/scroll, edit/reprojection, actual 422/409, branch/caregiver create 403, foreign-mother resume 403, and missing-header resume 401 all pass with horizontal overflow, console/page/failed-request count 0. This is current-pin regression proof, not booking-party browser confirmation proof: final review remains partial, confirmationReady=false, and confirm is disabled, so the browser never invokes the party-snapshot transaction. Production source completeness, sponsored-party binding, legal acceptance, confirmation-ready final confirm, clean four-repository pin, and deployment remain open. ADR-031 stays implementation: partial; P04 stays RED.
2026-07-18: backend 4f1eea71a240a6381c8695749d572cd85a21baeb removes the static booking/payment blocker tuple from partial final review. The ordered missingFactPaths set is now the readiness SSOT, explicitly includes supportAndDiscountDecisions, and derives both public disabledReasonCodes and capability reason codes. A resolved support authority removes that fact; an unresolved requested support selection keeps it fail-closed. The all-technical-authority test proves that resolved branch, plan, offering, caregiver, quote, support, charge, and payment handoffs remove stale booking/payment reasons, leaving only serviceContract.acceptance and contract_acceptance_missing. Global confirmation remains disabled because ADR-032 still lacks the exact product/legal acceptance items, wording/version, signature rule, and retention policy. Targeted regression is 14 passed, full regression is 7,040 passed, Tach affected is 457 passed with 6,562 deselected, and dependency/interface/exact/external diagnostics are zero. Ruff passes. Vulture confidence 100 reports three evaluated_at Protocol parameters; their implementations and calls are live, so none are deleted. Frontend 1c7bd8b2d6d23accfb01bf49dd57c7f2d079a4f0 maps the four server-owned blocker codes to exact Korean copy; 91 files / 580 tests, lint, Astro 7 check, and production build pass. No runtime actor, screenshot, WebP, migration, or deployment evidence was produced. ADR-031 remains implementation: partial; P04 stays RED.
2026-07-18: backend c27a69843196e04af88daf8011afd256a2a421cd turns the P04 clean full-history database proof into the repository command pnpm run supabase:test:customer-reservation-full-replay. A disposable AppArmor-scoped pinned PostgreSQL instance receives the pinned assembled GoTrue and Storage schemas before Supabase CLI 2.109.1 replays all 314 repository migrations. The gate verifies latest migration 20260718170000, public-schema lint error 0, the rollback-scoped exact-26 catalog materializer smoke, and removal of its container, network, and temporary directory. The CLI emitted a non-fatal pg-delta catalog-cache warning after the successful reset; lint and smoke still passed. No stage/production mutation, actor/browser/WebP run, legal acceptance, or deployment occurred. ADR-031 remains implementation: partial; P04 stays RED.
2026-07-19: backend 9d8c6e1460e520823a644ef6a8583c4886962df9 extends the same clean full-history command with seven rollback-scoped catalog smokes. Voucher-plan population, private-care publication, promotion entitlement, reviewed-empty regional support, rental equipment, service priority, and personality all pass after 314/314 migration replay and lint. The gate verifies 5 rental options, 3 priority options, 6 personality questions, 12 personality options, publisher registry 26, and a subsequent exact-26 materialization without leaving fixture rows. This is local data-authority evidence, not a fabricated non-empty support rule or a stage/production, actor/browser, legal, or deployment claim. ADR-031 remains implementation: partial; P04 stays RED.
2026-07-19: backend 44417324c8f41c8eb92ef7d930ee045d13e166af removes the remaining code-release requirement for rental-equipment product and charge changes. Pricing Settlement now owns a Layer-first immutable revision aggregate, application publication command/port, Supabase adapter, and production composition. Migration 20260718180000_rental_equipment_catalog_publication.sql adds a service-role-only publication RPC and append-only supersession lineage. The database computes source and catalog SHA-256 fingerprints, derives row counts, permits exact replay, rejects same-key fact drift, and never updates a previously published revision. Effective-date reads preserve the legacy five-item revision before 2026-08-01 and select a smoke-owned two-item replacement on and after that date. The disposable full-history gate passes 315/315, latest 20260718180000, public-schema lint error 0, seven catalog smokes, exact-26 materialization, and cleanup. The rental smoke also proves first publication, exact replay, conflicting replay rejection, historical read 5, replacement read 2, and service-role-only execution. Full Python regression is 7,049 passed. Ruff, Tach MCP boundary/external diagnostics, and Vulture MCP confidence-100 pass. No stage/production mutation, admin browser surface, actor screenshot, WebP, legal acceptance, or deployment occurred. ADR-031 remains implementation: partial; P04 stays RED.
2026-07-19: backend 31ac884512e2fd23294d7b84c9c4dee56ab978bf closes the production HTTP composition gap for rental-equipment catalog publication. The authenticated POST /hq/rental-equipment-catalog-revisions boundary derives the publisher from the active Supabase session, rejects client-controlled publisher and receipt facts, and checks the accepted hq_settlement:price_catalog_management#manage SpiceDB authority before the service-role RPC runs. The database records the first publisher, preserves that actor on an exact replay by another authorized caller, and still rejects same-key fact drift. The route is wired into the real main.py FastAPI composition and OpenAPI contract. Disposable full-history replay again passes 315/315, latest 20260718180000, public-schema lint error 0, seven catalog smokes, exact-26, and cleanup. Full Python regression is 7,062 passed; Ruff and Tach diagnostics pass with zero findings, and Vulture confidence 100 reports zero candidates in the changed production paths. This is authenticated boundary and database evidence, not an actual HQ actor browser run: admin UI, Chromium/WebP, stage/production deployment, and legal acceptance remain open. ADR-031 remains implementation: partial; P04 stays RED.
2026-07-19: backend 2e273307ddf0acb9fdeb991f4de7f54027b9790b and frontend 4996253db3f1da959d2aad131fde14e93882a665 close the code-level HQ rental-catalog management surface without moving product facts into UI constants. The backend adds a Layer-first application query that reuses the guarded service-role effective-catalog reader after active Supabase identity and the accepted hq_settlement:price_catalog_management#manage SpiceDB check. The real FastAPI composition exposes GET /hq/rental-equipment-catalog?effectiveOn=... beside the existing immutable publication POST. The Astro 7 admin surface uses an MUI navigation rail, a TanStack desktop table, a separate vertical mobile-card DOM, current revision cloning, entry reorder, source evidence, immutable receipt, and a cookie-derived same-origin server boundary. Cross-site publication POST is rejected before backend forwarding. Backend full regression is 7,067 passed; frontend is 95 files / 591 tests, lint and Astro check/build PASS. The registered seven-WebP browser pack proves desktop/mobile responsive behavior, zero overflow and zero console/request failures, but it intercepted the API route and did not use an authenticated HQ actor or backend. It is therefore provisional UI evidence with completionClaim: false, not an operational publication or deployment claim. ADR-031 remains implementation: partial; P04 stays RED.
2026-07-19: backend 4c9dd40fcef076d1e27fb5f053af82ad92f2cbb1 and frontend 3dd5779b4c1133d812786dbc0419c0d29234bd1e close the actual HQ rental-catalog administration subgate. A single disposable run applies all 315/315 repository migrations with pinned Supabase CLI 2.109.1, starts real GoTrue, PostgREST, Supabase PostgreSQL and SpiceDB, creates HQ and unauthorized actors, and serves the production FastAPI/Astro compositions without browser route interception. The authenticated HQ actor reads the current five-entry revision, adds a sixth entry and source evidence in the responsive admin UI, publishes an immutable revision, and reloads the receipt. The run proves exact replay, rejects altered same-key replay with unchanged database state, rejects unauthorized GET and POST with 403, and verifies revision count 2, supersession count 1, published entry count 6, evidence count 1, and original publisher lineage directly in PostgreSQL. Desktop table, Material rail, separate 390px mobile cards, overflow 0, browser diagnostics 0, WebP capture, actor/relation deletion, and disposable runtime cleanup pass. Full backend regression is 7,067 passed; frontend is 95 files / 591 tests; Ruff, Tach, Vulture, lint, Astro check and build pass. This closes the HQ administration subgate only: mother rental selection, same-revision quote/booking/payment/settlement and document consumption, production-source approval, legal acceptance, final confirmation, and deployment remain open. ADR-031 remains implementation: partial; P04 stays RED.
2026-07-19: backend 7f51408b9f5ba81452ec8923307fc43c251eeccf closes the code-level mother rental selection-to-finalized-charge lineage without copying product facts into reservation code. Pricing Settlement owns an explicit immutable cross-context contract containing the selected stable keys, labels, equipment and max-once delivery charges, branch-confirmation result, accepted offering, catalog revision, selection revision, and evidence keys. Final review derives rental quote lines and payable from that contract and adds both catalog and selection revisions to the replay-safe charge handoff. The accepted handoff translator requires the final-review selected options, offering, quote lines, and pricing revision keys to match exactly. Booking and Restate workflow input retain the same contract; finalized rental charge lines use the rental catalog revision instead of falling back to the base service price version. Unknown or duplicate options, an unconfirmed branch-required item, missing selection for rental quote lines, offering drift, amount drift, duplicate delivery, and pricing-lineage drift fail closed. Focused reservation/HTTP/charge regression is 153 passed; full Python regression is 7,079 passed; Ruff and Tach dependency/interface/exact/external checks pass with zero diagnostics. Vulture confidence 100 reports zero candidates in the new contract/query; twelve wider-path candidates are verified Protocol parameters and were not deleted. No new actor/browser/WebP, actual Supabase booking/payment workflow, settlement/document consumer, legal acceptance, deployment, or P04 PASS claim is made. ADR-031 remains implementation: partial; P04 stays RED.
2026-07-19: backend 288e14a788b88e8a319280de02f877dc1573667e and frontend 93b8c2e1f459e08538e92b94184834c90f0ed322 close the actual mother rental-selection-to-final-review subgate. The single-chat UI sends only the voucher day axis for voucher care; private duration/work axes stay null. Terminal PATCH publishes the exact test-owned voucher and rental catalogs, then timestamps the projection after authority preparation so a newly recorded authority cannot be rejected as future state. The mother selects health_cushion_rental; the final review returns service occurrences 10, equipment charge KRW 0, reservation-level round-trip delivery KRW 10,000, customer payable KRW 210,000, and exact rental catalog/selection SHA-256 handoff keys. Public quote lines use the pinned six-field contract and stable lower-snake component codes; policy lineage remains in the immutable charge handoff. A disposable GoTrue/PostgREST/Supabase/FastAPI/Astro same-origin run passes desktop/mobile ten-step chat, automatic focus/scroll, completed-card edit and eleven-section reprojection, actual 422, stale 409, non-mother 403, cross-session 403, and missing-header 401, with browser diagnostics and horizontal overflow at zero. The public evidence pack p04-live-rental-288e14a7-93b8c2e1 contains 45 files and 44 manifest assets. Backend full regression is 7,087 passed; frontend is 95 files / 592 tests; Ruff, lint, Astro check/build, and Tach checks pass. Vulture’s one confidence-100 candidate is a live Protocol parameter verified at its implementation and call site. Confirmation remains disabled because legal acceptance and booking handoff are absent; booking/payment, service-balance, settlement, document consumption, production source completeness, deployment, and P04 PASS remain open. ADR-031 stays implementation: partial.