# ADR-031 implementation history ledger Historical detailed evidence and gap log extracted from the published ADR on 2026-07-21. The ADR and actor-workflow SSOT own the current decision and status. This file is audit history, not current status authority. ## Current Partial Evidence - Backend `c6eb6f2c467c4ca1d3fd1855d2abc11b74e4416b`, contract `132e1a4e1077770247a17397efffceeb0699c045`, frontend `ffacc93939528f0e21d098d8fdf41bef3f978f07`의 [통합 P04 manifest](/evidence/mother-family-conversational-booking/p04-live-signature-c6eb6f2c-ffacc939/manifest.json)은 실제 owner desktop/mobile Chromium → production FastAPI → PostgREST → private Storage → signature READY→CONSUMED → atomic confirmation → exact replay를 통과했다. Supabase CLI migration `321/321`, actual `422/409/403/401`, durable evidence/consumption/command cardinality `1/1/1`, 예상 밖 browser error `0`, cleanup PASS다. 다만 contract bundle, approval, wording, signature/retention policy는 explicit synthetic test-owned authority고 실행 당시 assembly pin도 clean하지 않아 `implementation: partial`, `completionClaim: false`를 유지한다. - Contract commit `76b779b93d6af93a07043b04a07d2e2557b2c001` defines the five authenticated draft routes, 26 server option catalogs, new-versus-extension intent, the three independent voucher axes, corrected pet separation semantics, complete address and coverage review evidence, and isomorphic JSON Schema, TypeScript, and Python validation. Contract commit `8ce891f30026741efc2e20e3453979e078ae190c` publishes those generated Python models through the installable `sanmopia-python-contracts` namespace instead of copying transport DTOs into the backend. Its gates pass 419 Jest and 23 Python contract tests, and both sdist and wheel build successfully. - Backend commits `4fce929f66f7deec62a9856f4ba655249a71c055`, `9cf8718c42f9243a5a35e2d59ae30fb1697b2569`, and `e78a3bf16b87118460b6263f18a6929b4c09192d` provide the layer-first domain, application command/query, in-memory adapter, exact replay, stale revision, supersession, downstream invalidation, corrected 26-catalog and final-review invariants, atomic confirmation port, and declared Tach boundaries. They do not provide HTTP production composition. - Backend commit `21ecac5465eb70821338706fa861d0627e39990d` adds six backend-only Supabase tables and seven service-role-only RPCs for active draft slots, exact replay snapshots, immutable final-review projections, atomic confirmation, command audit, and outbox claim/completion/failure. Focused migration and access checks pass, but the migration has not been replayed on PostgreSQL. - Backend commit `0d78806` removes legacy partial-shape bypasses: applicant authority now requires new/extension intent, extension source, sponsorship, and delegated-payment fields, while care environment always requires the pet list plus reservation-wide newborn separation field. - Backend commit `ae989405c9f44588eb595a9090cad1e2bf3aff07` adds the concrete Supabase repository and atomic confirmation/outbox adapter over those RPCs, explicit column reads, exact snapshot/replay mapping, authority-projection and acceptance cross-checks, and typed fail-closed error mapping. The complete feature slice passes 91 tests, Ruff, Tach exact/external checks, and Vulture confidence-100 with zero findings. - Backend commit `6cc9d2efbb5d64b40628fe78ccabd1721f997513` mounts all five generated-contract draft routes in FastAPI, maps semantic revision and final-review conflicts to the generated structured `409` response, resolves the bearer to one active mother actor, and shares one concrete Supabase persistence adapter across draft, review, and confirmation handlers. The production option-catalog provider and final-review authority resolver remain explicit unavailable adapters, so create, update, final-review, and confirm fail closed instead of fabricating authority. The new HTTP, actor, runtime, feature, main, and architecture scope passes 140 tests; Ruff, Tach exact/external, Tach MCP, and Vulture confidence-100 pass. - Backend commit `558510d24d1a2fb1588ce9bfd08da41ba9aa0167` replaces both production unavailable placeholders with consumer-owned Supabase projection adapters. It requires the exact 26-key catalog set; its materialized snapshot format additionally uses one internal canonical order and fingerprint. It also requires the exact 13 final-review sections, actor/draft/revision/current-window scope, and exact requested review identity. Two service-role-only projection tables and two read RPCs preserve layer-first boundaries instead of deep-importing sibling feature adapters. Final-review GET remains read-only. Payable confirmation now fails closed until one atomic ADR-020 payment-obligation and handoff transaction exists; it no longer reads the obsolete `reservationCreationPaymentHandoff` key from final-review input. Local, non-canonical verification at that commit reported 147 focused feature/runtime/main passes, 13 architecture passes, zero Tach MCP exact/external diagnostics, and zero Vulture MCP confidence-100 candidates. The same local run reported applying the new migration to an isolated temporary PostgreSQL database and exercising both RPCs, including the null draft-revision guard. No immutable run artifact was captured. That smoke used minimal prerequisite tables; it is not a clean replay of the complete migration history or stage runtime proof. - Backend commit `1200f422231fd6894744f8c8cb72d989ef154ae8` adds a consumer-owned immutable contribution facade and inbox, the exact 26 catalog bindings, and a publisher registry that currently permits only `service_offering.offerings` from `reservation_operations.service_offering_availability`. The source command requires real title/version metadata and rejects any decision whose policy revision differs from the decision-set revision. The service-role-only RPC validates owner, draft, source revision, current window, registered producer, and idempotent fingerprint before appending a contribution. It intentionally does not materialize a catalog snapshot from 1/26 rows. Public decision-set request facts are not publication authority; trusted orchestration must first resolve the exact draft, branch, pricing, and birth context. Verification for this increment reported 191 focused passes, 1,110 Tach-affected passes, zero Tach exact/external diagnostics, zero Vulture confidence-100 candidates, and isolated PostgreSQL first-write/replay plus seed-drift rejection. No stage or immutable browser artifact was produced for this backend-only increment. - Backend commit `83ac5b89482950c5a9caec71468cf32db0d91dc0` completes two prerequisites for the consumer-owned exact-26 materializer without claiming that the materializer exists. Catalog contributions now preserve `authority_reference` and `authority_revision`; the two revision-required catalog keys fail closed unless both facts are present. Contribution writes use one owner/draft/revision scope lock, while direct `service_role` mutation of materialized snapshots and selection authorities is revoked and the access-control SSOT is select-only. A legacy 11-argument RPC wrapper forwards non-revision contributions to the expanded RPC so a database-first rollout does not break the current producer. Local verification reported 194 focused passes, zero Tach exact/external diagnostics, zero Vulture confidence-100 production candidates, and an isolated PostgreSQL smoke proving old/new overload replay identity, authority preservation, migration reapplication, and effective read-only snapshot privileges. The temporary database was deleted; no stage mutation or browser artifact was produced. - Backend commit `2c744fbdec26e06b8f3aef239eb2ffcefff24405` adds the second catalog producer boundary for `service_schedule.voucher_service_days`. Pricing Settlement now publishes and reads one immutable, normalized voucher-plan catalog revision selected by exact revision and pricing axes; it never derives the current/latest revision or rereads a mutable import batch. The revision freezes the slash-delimited legacy `SERVICE_DAY_LIST` token positions, exact option-to-price-line bijection, source entry codes, effective window, and source fingerprint. The one-option legacy positional inconsistency is deliberately normalized to `standard`; two and three options retain shortened/standard/extended source positions. The workbook parser also restores the previously skipped secondary caregiver net-pay component. Named orchestration maps the frozen revision to non-monetary `days_N` options and writes through the reservation-owned contribution port without a direct application feature import. Runtime composition and producer registration exist, but no trusted draft-trigger or catalog population job invokes them yet. Local verification reported 35 focused passes, Ruff success, zero Tach diagnostics, zero Vulture confidence-100 candidates, and an isolated real PostgreSQL first publish/replay/conflict/order/ACL/reapply smoke. The affected-test run reported 1,736 passes and the same three pre-existing access-control test failures at baseline `83ac5b8`. The temporary database was deleted; this backend-only increment produced no stage mutation or browser artifact. - Backend commit `c1937ed198005ce2307dfefc4e77d882aa98abc0` replaces the unavailable voucher revision population path with a completed source revision, ordered source slices, one atomic population publication, and a committed-population-only exact selector. Source completion freezes the published batch header and complete child-entry-set fingerprint, preserves source service-day order, and binds the explicit service-detail, baby, delivery, benefit-band, and day axes without inferring semantics from a `consume_type` prefix. Population publication checks every voucher entry, required/optional/additional component roles and bases, effective windows, source evidence, and deterministic replay before linking all revisions to one `population_key`; any later revision failure rolls back the whole population. Callers cannot choose a revision, batch, version, or `latest` fallback: the selector requires exactly one committed population row for the four canonical axes and quote date. Local verification reported 66 focused passes, an isolated PostgreSQL completion/publication/selection/ACL/rollback smoke, DB lint with zero results, zero Tach diagnostics, and zero Vulture confidence-100 candidates. The affected-test run reported 1,758 passes and the same three pre-existing access-control failures. No approved workbook/source completion caller, trusted draft-trigger invocation, stage mutation, or browser artifact was added by this backend-only increment. - Backend commit `b44fd49e9f3082d4affa005ecfa76128136f0804` removes caller-owned voucher revision selection from the reservation catalog bridge. The internal command now accepts only canonical service-detail, baby, delivery, consume-type axes and quote date; a Pricing Settlement decision port resolves the committed population's batch, revision, and version keys. The bridge independently rejects decision drift before reading the revision, and production composition binds the Supabase exact selector. Local verification reported 13 focused passes, 17 Tach-affected passes, zero Tach diagnostics, zero Vulture confidence-100 candidates, and Ruff success. This does not add a draft trigger: current PATCH sequencing still needs trusted canonical-axis resolution, the remaining producers, and one exact-26 same-set materializer before it can safely publish and refresh the next chat card. No stage mutation or browser artifact was produced. - Backend commit `7a9d26e1c1c53b928e14504cfd37152294f9a31f` adds the trusted HQ approval-to-population caller without choosing a business source. Bearer identity must resolve to an active Supabase session and pass SpiceDB `manage` on `hq_settlement:price_catalog_management`; caller actor, approval time, and manifest injection are rejected. PostgreSQL owns the first `approved_at` stamp and replay, derives canonical manifest SHA-256 from the frozen header, ordered slices, batch/workbook, and normalized entries, and requires exact workbook, catalog/version, and entry equality. Unapproved completion/publication service-role execution is revoked; approved RPCs only are executable. Existing unapproved populations remain stored but quarantined from resolve/publication, with immutability, insert, and deferred linkage guards. Focused verification reported 106 passes and one warning; fresh and populated-old-schema PostgreSQL smokes passed; 13 relation-aware PL/pgSQL checks, Tach all/exact/external, and Vulture confidence-100 returned zero diagnostics/candidates. Tach affected reported 1,880 passes and the same three unrelated baseline failures. No workbook/source/version was actually selected, approved, or invoked; `154 / 0` is not automatic approval. No stage/online deployment, browser run, screenshot, or WebP was produced. - Backend commit `20a79e30e36c6693002c65f8211275afbe149310` adds the consumer-owned exact-26 materialization path without claiming that it is invoked. The `MaterializeCustomerReservationStepOptionCatalogSnapshotHandler` loads one owner/draft/revision-scoped current contribution set, requires all 26 unique bindings in canonical order, validates current windows, source-revision consistency, and exact selection-authority coverage, and derives both the authoritative catalog fingerprint and frozen contribution-set fingerprint. Supabase source and sink adapters are composed in production runtime. Migration `20260715090000_customer_reservation_step_catalog_exact_set_materializer.sql` adds the current-set read RPC, expected-lineage/payload/window/fingerprint CAS materializer RPC, RPC-only 26-row lineage, idempotent replay verification, and a loader that returns a snapshot only while its frozen lineage still equals the current 26 contributions. Focused application, adapter, and runtime verification reported `193 passed`; a narrower integrated materializer run reported `38 passed`, and migration/SSOT contracts reported `14 passed`. The rollback-scoped isolated Supabase PostgreSQL 17 smoke proves exact-25 atomic failure, exact-26 snapshot plus 26 lineage and five authority rows, idempotent replay, stale CAS `40001`, lineageless rejection, invalid/expired newest-row no-fallback, cross-time-zone fingerprints, Python/Unicode canonical hashes, RLS, and service-role RPC-only access. PL/pgSQL error checks, Ruff, Tach all/exact/external, Vulture confidence-100, and `git diff --check` returned zero findings. This is pinned backend evidence, but it is not a full-history reset, stage, or production-source proof. No trusted draft trigger calls the handler, 24 producers are absent, and no complete production contribution set exists. No deployment, browser success, screenshot, or WebP was produced or reused for this backend-only increment. - Backend commit `863158c743e2bc48e3db1dbb1a1f9d65edb0892d` stages the consumer-owned catalog-preparation authority without activating an incomplete workflow. Migration `20260715100000_customer_reservation_catalog_prepare_authority.sql` accepts an exact 17-key service-role payload, owns its SHA-256 projection identity, monotonic revision, 15-minute-or-shorter window, replay, RLS, and strict record/load RPC ACL. The loader rejects scope, hash, projection-id, draft, window, and malformed `service_offering` drift without falling back to an older row. Named orchestration can consume that projection, preserve its lineage in the existing service-offering and voucher-day contributions, and attempt the exact-26 materializer. It is deliberately unreachable from HTTP, PATCH, queue, trigger, or worker execution. The offering reader also resolves duplicate applicable rows deterministically with branch-and-region > branch > region > global precedence, then newest `effective_from` within the winning scope. Focused verification reported `65 passed`; Tach affected reported `1,932 passed`, the same three unrelated access-control baseline failures, and `3,405 deselected`. Ruff, Tach all/exact/external, Vulture confidence-100, and diff checks returned zero findings. A disposable PostgreSQL run pinned migration SHA `273c753dd2fa5f4c08a14bc2a2f65c7ed44832f25d256729c5123aa0fd4ba900`, applied and reapplied it, proved revision `1 -> 1 -> 2`, exact replay, renewal with a new identity and stable payload fingerprint, six fail-closed cases, service-role SELECT-only table access, service-role-only RPC execution, and zero PGMQ, queue, or trigger objects. The temporary database was removed and the residual database count was zero. This remains preparation infrastructure, not trusted source authority: no source-owned 17-axis resolver/recorder or caller exists, only 2/26 producers exist, and no refresh path renews the short-lived projection. No deployment, browser run, screenshot, or WebP was produced. - Backend cleanup commit `406d56565eae8ff51a7ec354a1c68aadb11db90c` aligns the existing authority-lineage smoke, and backend commit `59d29eb79359018f116c0be941c6d1a288e44e5c` adds the consumer-owned v2 preparation boundary without activating it. Draft-owned derivation now keeps birth state, calendar distance, actual baby count, and continuation request separate from five owner decisions: `branch_coverage`, `reservation_state`, `service_offering_policy`, `price_catalog_version`, and `voucher_plan_criteria`. Each decision carries exact owner, reference, revision, SHA-256, and validity-window lineage. Migration `20260715110000_customer_reservation_catalog_prepare_authority_v2.sql`, SHA-256 `a980b468843ebd07d58b3952d122748d82e77dcfca9277eae210344452aa7d92`, fingerprints payload plus lineage, uses the database statement time, requires `evaluated_on` and `quoted_on` to equal the Asia/Seoul business date, and caps expiry at the draft expiry, 15 minutes, the earliest source expiry, or the next Seoul midnight. Its loader accepts no caller-owned clock and rejects a stale, legacy, corrupt, or lineageless newest row without fallback. The legacy semantics are also separated: current pre-reservation is not historical pre-reservation conversion, extension intent is not a server-linked continuation, the 40-day window is inclusive, actual baby count is not voucher baby classification, and a source price-version id is not a calendar version number. Offering publication now requires this preparation-authority lineage; the public availability routes remain preview-only. Focused verification reports `109 passed`; the full suite reports `5,427 passed` plus one historical security-validator failure. Ruff on `src`, Tach exact, and Vulture confidence-100 pass with zero new findings. An earlier disposable PostgreSQL 17 v1-to-v2 smoke passed. This backend-only increment produced no deploy, stage, browser, screenshot, or WebP evidence. - Backend commits `be107c7f7022e89ac5d118a07818c319a57ecd4c` and `e913dc30afe0a213dc642804f8a840c97643ee7c` remove authenticated table authority and make workflow progress, assembly reads, and repair entrypoints fail closed when bearer authorization is absent or unconfigured. - Frontend commits `4288924d900d69cd1376f2aed5ca37f302982139` and `421fc03c826a86818f52d47d0b305cbae500ff70` bind the single-chat timeline to the corrected contract, including new-versus-extension selection, voucher axes, corrected pet semantics, complete final-review rendering, authenticated progress polling, reload, conflict, validation, edit, focus, and scroll behavior. Browser and backend integration evidence remain separate gates. - Frontend harness commit `b460d84e7299e808c7e34e3f8688168a3c1f387f` captures real Chromium desktop/mobile 12-frame WebPs plus edit invalidation, stale-revision conflict, and server-validation branches. Its manifest is explicitly `provisional`, `completionClaim=false`, and `runtimeEnvironment=local_astro_mocked_api`; it is UI behavior evidence, not backend runtime or durable-persistence proof. - Backend commit `3d5f3cbf9f867c5c14e1aba81a8182ae30598098` pins the first actual local GoTrue/PostgREST P04 draft acceptance through the production Supabase HTTP adapters. Four roles prove unauthenticated `401`, non-mother create `403`, foreign-owner read `403`, typed validation `422` without mutation, stale-revision `409`, exact create/PATCH replay, ten step patches, revision `1 -> 11`, and zero Auth/draft/replay cleanup residue. The exact-26 option set in this run is explicitly test-owned and does not create final-review authority. A fresh migrated database registers 12/26 production publishers, including `contract_and_payment_preference.payment_methods` from `pricing_settlement.payment_product_plan`; production final review therefore remains fail-closed `503`. Focused and broad P04 tests report `332 passed` with one framework warning; Tach exact/external and Vulture confidence-100 on changed production files pass. No production browser, screenshot, WebP, automatic draft snapshot trigger, final-review materializer, or booking handoff is claimed. - Backend commit `20c74e60776627cf9dc078775e4a0b75f65beebf` adds the Member Management application query, Supabase source adapter, and orchestration publishers for `applicant_authority.sponsorship_references` and `applicant_authority.delegated_payment_references`. Raw grant/delegation identifiers remain backend-only selection-authority lineage; the browser receives deterministic opaque references. A fresh migration registers `14/26` production publishers. The five-actor local acceptance proves one sponsorship option and one unscoped delegated-payment option through the production query/adapter/inbox/materializer while the other 12 catalogs stay test-owned. It reports `496 passed` across the reservation/family regression, focused `12 passed`, Ruff, Tach exact/external, and Vulture confidence-100. Final review remains fail-closed `503`; no browser, WebP, deploy, or P04 PASS is claimed. - Backend commit `8e5465cc5da0969e0f0af79c19c326071627c4cf` adds Layer-first `customer_action_availability` query/command slices, a lineage-preserving Supabase adapter, and the source-owned publisher for `applicant_authority.eligible_extension_source_reservations`. The public option and catalog authority are deterministic opaque references; raw reservation id and projection revision remain only in selection-authority lineage. Fresh migration registers `15/26` production publishers. The five-actor run proves one eligible extension option in addition to the two family options, while actual execution caught and corrected stored-payload casing drift and cross-producer preparation-lineage mismatch before this pin. The reservation/action/family regression reports `520 passed`; Ruff, Tach exact/external, Vulture confidence-100, and zero-residue cleanup pass. Final review remains fail-closed `503`; no browser, WebP, deploy, or P04 PASS is claimed. - Backend commit `2882ae0045b6356f1a4b2fcce9d0b22986bdf5ec` adds the Layer-first approved voucher income-type query and port, guarded Supabase RPC/adapter, and orchestration publisher for `service_offering.voucher_income_types`. It preserves the approved population source order and actual `consume_type_value`; browser options expose stable consume keys and labels without source evidence identifiers. Supabase CLI migration registers `16/26` publishers. The approved-population DB smoke resolves `consume_type_a_ga_1` as `A-가-1형`, rejects a missing axis, and rolls back to zero source/population/revision rows. Full Python regression has `6,727 passed`; after pruning one stale Tach dependency declaration, architecture target `16 passed`, latest-change target `29 passed`, Ruff, Tach exact/external, and Vulture confidence-100 pass. This is a source DB gate, not a new five-actor browser run or P04 PASS claim. - Backend commit `1fd9cddac03f09385ec20f3c8e5a3b9678d4bdcb` adds the Layer-first owner-scoped promotion-entitlement query/port, guarded Supabase RPC/adapter, and orchestration publisher for `contract_and_payment_preference.promotion_entitlements`. It reads only the authenticated draft owner's current `issued`/`restored` reservation-discount entitlements, preserves rule/entitlement revision lineage, and supports a proven empty catalog. Browser options expose a stable key and `promotion-entitlement:` selection reference; raw entitlement UUIDs remain internal selection authority. The publisher is invoked during trusted catalog preparation. Authority expiry is capped at the earliest entitlement expiry, and DB triggers revoke a frozen authority when a relevant entitlement fact changes, is redeemed, or is deleted. Supabase CLI migration and rollback-scoped PostgreSQL smoke register `17/26`, prove owner isolation, the opaque/raw split, empty-owner behavior, and revocation after redemption/revision change. Full Python regression has `6,737 passed`; the relevant subtree has `72 passed`, and Ruff, Tach exact/external, and Vulture confidence-100 pass. This is not a new actor/browser/WebP run or P04 PASS claim. - Backend commit `293fe13d39f09bc610f6b8f6071f08c74798f398` replaces the legacy private-care workbook loader boundary with a dedicated normalized parser. The source workbook is `source-refs/sanmopia-admin/static/dist/excel/price/2026_normal_260119.xlsx` at source commit `437c43cb40f414b18091cfea8369c9334139424f`, SHA-256 `ad3235e4f35108936c816046ec2da4522a3ff189c8c7b3f9a6443b79b07dd65b`. Actual parsing produces 20 complete private-care entries and zero issues. Stable codes, one normalized row model, declarative component rules, explicit duration conversion, whole-KRW checks, and fail-closed unknown or reintroduced removed values replace PHP lookup ids, implicit `empty()`, repeated insert/update branches, and silent infant-price deletion. Focused parser tests report `3 passed`; the price-catalog slice reports `111 passed`, with Ruff, Tach exact/external, and Vulture confidence-100 passing. This discovers and normalizes source authority; it does not register any of the remaining 9 publishers, approve a durable private-care revision, or provide browser/WebP evidence. - Backend commit `f18687890d137d7dd38f0452b15c8c9087e64849` adds the private-care published-batch application contract, exact Supabase source adapter, domain-owned reservation projection, and three orchestration publishers for `service_schedule.durations`, `service_schedule.work_schedules`, and `additional_services.service_options`. Duration 4, work schedule 2, and service option 10 are derived from one normalized entry set; browser options do not copy KRW amounts out of the price-entry SSOT. The shared five-day-week rule moved to the domain and the workbook adapter imports it. Publication now goes through one service-role RPC that owns DB time and a canonical SHA-256 fingerprint; published batches and entries are immutable, and caller-stamped `published_at` paths, including stage smoke seed, are removed. Supabase CLI applies the migration and registers `20/26`. A rollback-scoped real PostgreSQL smoke with two representative entries proves first publication, exact fingerprint replay, mutation rejection, and residue zero; DB lint has no errors. Full Python regression has `6,750 passed`, the focused target has `121 passed`, and Ruff, Tach exact/external, and Vulture confidence-100 pass. This does not prove the actual workbook's 20 entries were durably published, automatic draft preparation, final review, browser, or WebP. - Backend commits `f71170efe03d973400b7fc1ef8fe46306c0d6bd8` and `cd57234f8e407b8fc94c1aa3d6e34c831affee6b` bind `service_offering.voucher_delivery_rank_and_workforce` to one approved voucher population. The source RPC preserves the first workbook position of each stable delivery code and rejects missing or multiple source revision/population authorities. One domain presentation policy derives delivery-rank labels and workforce counts; legacy numeric ids, `id - 1`, and quadruplet id switches are not copied into the contract. The source adapter, query, orchestration publisher, and production runtime share the exact population fingerprint and preparation lineage. Supabase CLI migration registers `21/26`; rollback-scoped PostgreSQL smoke proves source order, approval lineage, service-role-only execution, and rollback residue zero. Source review also found that the workbook adapter read `P:W` while the PHP loader and workbook use `Q:X`. The named B:X column contract now includes X and normalizes the known deleted-service marker. The pinned voucher workbook `source-refs/sanmopia-admin/static/dist/excel/price/2026_voucher_260119.xlsx` is source commit `437c43cb40f414b18091cfea8369c9334139424f`, SHA-256 `621a7667b326a3184bea2910b7fc49bbda553c93061d3f91af42d3cb70562a8c`; actual parsing is `ready_to_publish`, `198/198` entries, issue `0`, four baby groups, and eight delivery codes. Full Python regression is `6,768 passed`; DB lint, Ruff, Tach exact/external, and Vulture confidence-100 pass. This is source and DB evidence, not a new actor, browser, or WebP run. - Backend commit `816bc09f04411d5a8d2cc660d140799a9daf1f6c` binds `additional_services.rental_options` to one immutable, source-reviewed rental revision. The evidence set pins the live `LIST_RENTAL_TB` loader, five-option survey order, reservation UI, delivery constant, and admin billing branch from web commit `9183261e` and admin commit `437c43cb`. Five stable option keys replace numeric database ids. Equipment charge is KRW 15,000 only for the breast pump; round-trip delivery is KRW 10,000 at most once per reservation; only the breast pump requires branch confirmation. The application query builds the existing domain `RentalEquipmentChargeCatalog` from those same approved rows, so reservation presentation and settlement do not own separate rate tables. The guarded RPC verifies exact entry and source evidence counts, contiguous order, canonical SHA-256 fingerprints, service-role-only execution, and immutable rows. Production preparation and runtime composition publish the same revision lineage. Supabase CLI migration and rollback-scoped DB smoke register `22/26`; full Python regression is `6,779 passed`, DB lint and Ruff/Tach pass, and changed production files have no Vulture confidence-100 finding. This is not a new actor, browser, or WebP run. - Backend commit `d4b8e4677663b30bcf6d8df1806c0b89a73bdc3c` binds `caregiver_matching.priorities` to one immutable, source-reviewed service priority revision. Web source commit `9183261e` proves the legacy `LIST_PREFERENCE_TB` loader, three ranked selects, exact `0/1/2` labels, sequential persistence, and replacement behavior. Public options replace those mutable numeric codes with `postpartum_care`, `newborn_care`, and `household_care`; the domain owns `ordered_unique` selection with a maximum of three. The same catalog translates ordered UI choices into the existing `CaregiverServicePreference` matching input, so chat presentation and the matching algorithm cannot drift into separate code/priority tables. The guarded RPC verifies three contiguous rows, exact source evidence, canonical catalog and source SHA-256 fingerprints, service-role-only execution, and immutable rows. Production preparation and runtime composition publish the exact approval/catalog/source lineage. Supabase CLI migration and rollback-scoped DB smoke register `23/26`; full Python regression is `6,796 passed`, DB lint has error `0`, Ruff/Tach pass, and changed production files have no Vulture confidence-100 finding. This is not a new actor, browser, or WebP run. - Backend commit `87e63f27de0bbdf0cb027e9cb7e0b257799a2cfc` binds `caregiver_matching.personalities` to one immutable, source-reviewed six-question catalog. Web source commit `9183261e` proves the six paired survey questions, database grouping/order, required-answer browser check, transactional replacement, numeric-id persistence, and matching score consumption. Twelve stable `question.answer` option keys replace public numeric ids. One domain catalog owns the `exactly_one_per_question` rule, six-by-two shape, contiguous order, duplicate/unknown rejection, and translation into the existing `CaregiverPersonalityAnswer` matching input. Four legacy spacing/typo defects are normalized explicitly and included in the catalog fingerprint rather than patched independently in UI code. The guarded RPC verifies twelve rows, seven exact source anchors, catalog and source SHA-256 fingerprints, service-role-only execution, and immutable rows. Production preparation and runtime composition publish the same approval/catalog/source lineage. Supabase CLI migration and rollback-scoped DB smoke register `24/26`; full Python regression is `6,806 passed`, DB lint has error `0`, Ruff/Tach pass, and changed production files have no Vulture confidence-100 finding. This is not a new actor, browser, or WebP run. - Backend commit `adeae516b62d6a8a6b8ad0b8c5572cc47c0f5bce` binds `contract_and_payment_preference.support_programs` to regional-benefit authority. Web source commit `9183261e` proves the legacy 완주군 support branch was spread across address string checks, price-version `<= 3`, five-day add/subtract display logic, DOM state, and option labels, while 영등포구 was removed on 2023-02-01 but left stale UI/model branches. The modern binding keeps support programs behind `RegionalBenefitRule` region codes, price catalog version windows, source evidence, and revision keys. The current v4+ authority is a reviewed empty catalog; v1-v3 fail closed until exact support option rows and price authority exist. Production preparation and runtime composition publish the same approval/catalog/source lineage. Supabase CLI migration and rollback-scoped DB smoke register `25/26`; full Python regression is `6,816 passed`, DB lint has error `0`, Ruff/Tach pass, and changed production files have no Vulture confidence-100 finding. This is not a new actor, browser, or WebP run. - Backend commit `a325e02f457a893edf1c21536333c3875877c284` binds `caregiver_matching.recommendations` to existing frozen caregiver recommendation-set authority. The legacy path generated recommendations in `Service.php:594-623` and exposed raw `MANAGER_ID_PK` through `reservation_check_data.php:147-219` plus `reservation_check_data.js:1-21`. The modern catalog does not introduce a new matching algorithm; it reads the latest unambiguous `CaregiverCandidateRecommendationSet`, publishes opaque `selectionReference` values, and keeps raw candidate/profile ids inside internal selection-authority lineage. The catalog carries decision authority reference and revision, so specific recommendation selection must echo the expected decision. Direct local PostgreSQL migration and rollback-scoped DB smoke register `26/26`; full Python regression is `6,820 passed`, DB lint has error `0`, Ruff/Tach pass, and changed production files have no Vulture confidence-100 finding. This is not a new actor, browser, or WebP run. - Backend commit `a7dbc0e7c6f4990bbbac980f38a25ff99a596f3e` adds a server-built partial final-review projection materializer and Supabase recorder wiring. The final writable PATCH now records a 13-section contract-valid projection from the exact catalog snapshot. The projection deliberately remains `confirmation_ready=false` with `authoritative_projection_partial`, `booking_handoff_missing`, and `payment_handoff_missing`; it is not a booking or payment success claim. Reservation-creation regression is `351 passed`; full Python regression is `6,823 passed`; Ruff, Tach, Tach external, and Vulture pass. - Backend commit `48a1c4296494db58009e029d50263b8816aa3e52` replaces the first partial projection's placeholder display facts with retained draft/catalog facts for mother contact, home/service address, service offering, duration, work schedule, additional service options, rental options, caregiver selection mode, and selected payment method. This deliberately remains `confirmation_ready=false`; coverage, calendar, price quote, legal contract, payment, and booking handoff authority are still missing. Reservation-creation regression is `351 passed`; full Python regression is `6,823 passed`; Ruff, Tach, Tach external, and Vulture pass. - Backend commit `a759da441b10c56805d76e9e4335aa93b847d310` retains requested service schedule occurrences in the same partial projection. Desired start, selected Saturday dates, and selected holiday dates are date-validated, deduplicated, sorted, sequenced, and reflected in `serviceOccurrences`; the partial `serviceEndOn` follows the last retained occurrence. This is still not authoritative calendar allocation or payable booking. Reservation-creation regression is `351 passed`; full Python regression is `6,823 passed`; Ruff, Tach, Tach external, and Vulture pass. - Backend commit `70ea0ca3020ad0f59ac793d26d23d4962bcde169` binds the branch-owned service-area policy into partial final review through a read-only feature-local query port and named orchestration bridge. It resolves the exact current catalog-preparation authority, source branch profile, requested service date, and normalized service address, then retains lookup candidates, matched key/depth/rule, coverage profile, impossible-area veto, policy revision, and address evidence fingerprint. Only a resolved authoritative decision removes `branchServiceAreaDecision` from missing facts and `BRANCH_COVERAGE` from invalidations. An absent preparation authority keeps the existing partial projection; a present but inconsistent branch/profile scope fails closed. P04 plus branch regression is `442 passed`; full Python regression is `6,829 passed`; Ruff, Tach exact/external, and Vulture pass. No schema, actor, browser, or WebP evidence changed. The attempted direct Supabase CLI lint URL returned `LegacyDbConnectError`, so this commit does not claim a new DB lint result. - Backend commit `98bf0283b91192990d030f1054d00c33feee51e6` replaces the final-review requested-date placeholder with the existing authoritative service-calendar policy when all required authority exists. The Layer-first read query resolves the service-area rule's calendar profile, its effective Supabase policy-profile revision, national and matching-branch holidays, and the structured `serviceDayCount` from the selected current catalog option. The existing calendar domain computes billable occurrences, skipped weekends/holidays, extension days, end date, and policy fingerprint. Only a resolved plan removes `eligibleServicePlan` from missing facts and `SERVICE_PLAN`/`SERVICE_CALENDAR` from invalidations. Missing legacy option metadata or a missing current policy profile preserves the partial review; malformed authority fails closed. Voucher catalog publication now emits `serviceDayCount` explicitly instead of requiring option-key parsing. Full Python regression is `6,835 passed`; the affected feature/context regression is `192 passed`; Ruff, Tach exact/external, and Vulture confidence 100 pass. No schema, actor, browser, screenshot, WebP, or deployment evidence changed. - Backend commit `a4c6ffbd8003c5899542198531d05e805798b5e3` binds the pricing-owned published catalog to partial final review without introducing a second price algorithm. Private-care duration and work-schedule catalogs now retain source-owned `applicableEntryCodes`; voucher service-day options retain the exact `priceCatalogEntryCode`. The final-review bridge intersects private-care lineage or consumes the exact voucher entry, then asks the existing `PriceCatalogQuotePolicy` to quote the current effective Supabase publication. Only one exact matching entry clears `priceQuote` from missing facts and `PRICE_QUOTE` from invalidations. Missing legacy metadata, no current publication, or multiple candidates preserves partial state; malformed/conflicting lineage fails closed. No amount is copied into option catalogs and no option key is parsed as pricing authority. Full Python regression is `6,841 passed`; focused regression is `24 passed`; Ruff and Tach exact/external pass. Vulture confidence 100 reports only seven pre-existing findings outside this change. No schema, actor, browser, screenshot, WebP, or deployment evidence changed. - Backend commit `4166ddf1f6cf038409e22e953f1bf8183c87c120` adds the pricing-owned `ReservationCreationChargeSnapshotHandoff` query beneath a Layer-first application feature. It derives one stable, replay-safe handoff id from draft revision, exact price-catalog revision, entry, and payable amount. A resolved quote now supplies matching `customerShareAmountKrw` and `pricingRevisionKeys`; only then does final review clear `reservationCreationChargeSnapshotHandoff` from missing facts. This handoff is not a prematurely finalized booking snapshot. Payable confirmation must still consume it in one transaction that creates reservation acceptance, finalized charge snapshot, ADR-020 obligation, payment handoff, and outbox facts. Full Python regression is `6,843 passed`; focused regression is `11 passed`; Ruff and Tach exact/external pass. Vulture confidence 100 reports only seven pre-existing findings outside this change. No schema, actor, browser, screenshot, WebP, or deployment evidence changed. - Backend commit `121f786ca395491bc1daee7e91b971d687da1cbd` resolves `paymentPreparation` from the selected method, current draft-scoped payment catalog, and authoritative quote payable amount. The pricing-owned query rejects a selected method outside current eligibility, including legacy `bank` when no current plan permits it. A resolved result exposes eligible labels, `paymentRequired`, and the unchanged payable amount, then clears only the payment-preparation missing fact and invalidation. It does not call a provider, create an ADR-020 obligation, or clear global `payment_handoff_missing`. Full Python regression is `6,847 passed`; focused regression is `13 passed`; Ruff and Tach exact/external pass. Vulture confidence 100 reports only seven pre-existing findings. No schema, actor, browser, screenshot, WebP, or deployment evidence changed. - Backend commit `8e7b88bfe458709ad286759fcf74b025415290d2` makes payable confirmation consume the exact reviewed charge-snapshot handoff and payment preparation. It freezes one `waiting` `reservation.customer_share.deposit` obligation with selected and eligible method codes, amount, currency, pricing revisions, draft/review revisions, and the existing public seven-field `ReservationCreationPaymentHandoff`. One Supabase wrapper transaction validates the obligation against the persisted final review, commits draft confirmation, acceptance, command, and outbox, then inserts the obligation; mismatch rolls the statement back. Exact replay returns the original handoff. Provider payment is not invoked. Focused regression is `32 passed`; full regression is `6,851 passed`; Ruff and Tach exact/external pass. Vulture 100 reports only the same seven pre-existing findings. Supabase CLI applied migration `20260718103000` to the disposable P04 database and DB lint returned no error. Clean full-history reset was not proved because local Supabase bootstrap stopped when Realtime exited `134` and `auth.jwt()` was absent. No actor, browser, WebP, stage, or deployment evidence changed. - Backend commit `d29f6b7aed8a938f4fc0c5537f50127493314744` consumes the already-frozen draft-scoped caregiver recommendation catalog in final review. It resolves the candidate decision only when one exact catalog, decision authority reference/revision, enabled unique opaque candidate references, and the draft selection intent agree. Stale revisions, duplicate/disabled/malformed options, and unknown selected references remain partial and invalidated. It does not expose a raw legacy caregiver id as browser authority or invent a new matching algorithm. Focused regression is `6 passed`; full regression is `6,853 passed`; the public Python contract, Ruff, and Tach exact/external gates pass. No new actor/browser/WebP evidence or global readiness is claimed. - Backend commit `7a345e7b64d3abbe1009ee0f95b6453849d8b729` treats no support selection as an authoritative empty decision only when both current support-program and promotion-entitlement catalogs exist and both draft request arrays are actually empty. Missing catalogs or any requested item remain invalidated; the projection does not fabricate a zero-value discount without pricing-owner amount and policy revision authority. Focused regression is `8 passed`; full regression is `6,855 passed`; Ruff, Tach exact/external, and a confidence-100 Vulture scan of changed files pass. - Backend commit `867ba51f07bb1d1ed3c66be463f06ef493257797` resolves selected promotion entitlements through the Pricing Settlement owner rather than trusting browser order or raw entitlement identifiers. It revalidates the frozen catalog against the live owner catalog revision, applies multiple coupons in catalog source order, caps the applied amount at the reviewed customer payable, and records full, partial, or not-applied decisions behind opaque revision keys. The adjusted payable and customer credit feed the same final-review quote, charge handoff, payment preparation, and atomic waiting-obligation path. Legacy PHP evidence at `Reservation_model.php:1200-1205`, `:1261-1262`, `pre_reservation_payment.php:123-127`, and `modal_change_payment.php:5-13` proves multi-coupon summation and the zero payable floor. A selected regional-support request remains fail-closed and emits no base quote or charge handoff until its pricing-owner amount rule is integrated. Full regression is `6,864 passed`; Ruff, changed-file format, Tach exact/external, and changed-production Vulture confidence 100 pass. - Backend commit `b7894b89f48c7423b70fcc6cc72bfd0a62ead2a7` connects the existing durable confirmation outbox RPCs to a typed production adapter and runtime. Claim preserves database order and increments an attempt CAS; complete and fail require the exact attempt and exactly one returned row. The adapter freezes the event payload and rejects malformed lifecycle rows. This opens the missing consumer entrance but does not yet translate the accepted projection into a booking command or mark P04 ready. Focused regression is `6 passed`; full regression is `6,868 passed`; Ruff and Tach exact/external pass. Changed production files have no confidence-100 Vulture finding; four existing protocol-placeholder findings remain outside the new adapter. - Backend commit `0676b50eaedbb519c95e30071bfa6a6b3f4a2cc2` replaces label/order/amount-hint inference with one versioned execution-mapping port. Stable offering, duration or voucher-day, work schedule, exact price-entry code, and authoritative service-day count must match exactly one source-owned option. Missing lineage, no match, or ambiguity remains partial. The resolved legacy numeric IDs are fingerprinted and persisted only in `internal_booking_execution_mapping`; the public final-review contract remains exact and contains no numeric booking IDs. Runtime composition crosses contexts only through the declared application port, with Tach dependencies documenting the adapter wiring. Full regression is `6,876 passed`; Ruff, Tach exact/external, and changed-production Vulture confidence 100 pass. This freezes the booking-command input but does not consume the outbox or execute the booking workflow. None of these commits proves a clean full-history PostgreSQL replay, populated owning-context authority projections, finalized booking snapshot materialization, or deployed mother booking. Atomic obligation and public payment handoff now exist, but global confirmation readiness is still disabled. The evidence list keeps canonical runtime, booking, and legal gaps open. ## Known Gaps - The corrected public contract retains the audited legacy intake axes, and the HTTP/runtime shell plus consumer-owned production resolvers are pinned. A fresh database at backend `a325e02f` registers 26/26 source-owned publishers: five birth catalogs, four legacy reference catalogs, service offerings, voucher delivery rank/workforce, voucher income types, voucher service days, private-care durations/work schedules/service options, payment methods, sponsorship, delegated payment, eligible extension sources, and owner promotion entitlements, rental options, caregiver service priorities, caregiver personality choices, regional-benefit support programs, and frozen caregiver recommendations. Frozen caregiver and selected-promotion final-review decisions now bind when exact current authority exists. Automatic draft-scoped contribution refresh and selected regional-support, contract, and booking final-review materializers are missing. Completed-source and atomic voucher population authority and the HQ-approved completion caller exist. A rollback-scoped approved-source smoke is invoked, but no real production workbook/source/version has been selected or approved. Backend `20a79e3` contains the atomic exact-26 handler, Supabase runtime composition, same-set CAS RPC, persisted ordered lineage, and current-lineage loader gate. It is not called by a trusted draft prepare or PATCH trigger and cannot succeed with an incomplete production registry. A newly published current contribution makes an older snapshot fail closed; a partial or stale contribution set is never promoted or served. Missing or partial rows now have a server-recorded partial final-review projection at backend `70ea0ca3`; retained display and requested-schedule facts are bound from actual draft/catalog state. Current preparation authority can also bind the exact branch service-area policy decision, while authority-absent drafts retain the coverage missing fact. Discount-only accepted regional-benefit decisions now reach the booking command, but real non-empty runtime proof, contract/legal authority, finalized booking, and universal activation coverage are still missing, so no production success claim is valid yet. - Backend `59d29eb` replaces the unlineaged v1 write shape with typed draft derivation, five consumer-owned source contracts, one record handler, a Supabase recorder/loader, and exact v2 source lineage. It still does not close trusted preparation: concrete owner adapters are `0/5`, record-handler runtime wiring is incomplete, and activation surfaces remain absent. The dormant preparation handler does not publish a current exact-26 production set and no create/PATCH trigger refreshes the projection. Public availability endpoints are non-authoritative previews; booking still accepts a caller-provided decision and must rehydrate the exact server projection before activation. Readiness still requires five concrete source adapters, server-side booking rehydration, scoped contribution refresh, and one atomic record-plus-outbox/enqueue boundary. Source-owned publisher registration is no longer the blocker after backend `a325e02f`. - Backend `8e7b88bf` implements the atomic payable command boundary that consumes `ReservationCreationChargeSnapshotHandoff`, creates the ADR-020 waiting obligation and `ReservationCreationPaymentHandoff`, and commits acceptance plus outbox together. Remaining work is the separately persisted finalized booking charge snapshot, booking workflow materialization, global readiness activation, real-database concurrency/rollback proof, and actor evidence. Non-payable confirmation also remains unavailable until its complete authority projections exist. - Contract retention, legal acceptance wording, and any signature requirement need explicit product and legal policy evidence before proposed [ADR-032](./adr-032-customer-reservation-contract-acceptance-evidence/) may be accepted or implemented. - Supabase schema, RPCs, and the concrete adapter now represent atomic persistence and outbox repair semantics, but clean PostgreSQL replay, real-database concurrency and rollback, and stage proof remain required. A mocked browser run or in-process HTTP test does not prove them. - Family-sponsored booking remains a separate accepted authority flow under ADR-021 and needs its own card-to-grant/draft/acceptance evidence. - ADR-028 is accepted and partial. This ADR does not upgrade its implementation or evidence state.