架空例: 重複・逆順 webhook と期限競合に耐える 7 日間の支払猶予

この文書の account、時刻、SHA、digest、test 結果、観測値、actor はすべて架空であり、実システムの検証証拠ではない。書式間の traceability と veto の使い方を示す教材である。

Evidence index

Field	Synthetic value
change_id	CHG-20260801-billing-grace
task	TASK-billing-grace@1
ADR	ADR-0042@1
threat model	TM-CHG-20260801-billing-grace@1
eval	EVAL-CHG-20260801-billing-grace@1
PR	PR-184@synthetic
release	REL-production-20260801-01
source SHA	1111111111111111111111111111111111111111
source-tree/review tuple hash	sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
authoritative EVID run manifest	EVID-RUN-35@sha256:7777777777777777777777777777777777777777777777777777777777777777
approved deploy manifest	DEPLOY-MANIFEST-01@sha256:6666666666666666666666666666666666666666666666666666666666666666
runtime promotion manifest	PROMOTE-MANIFEST-01@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
artifact digest	sha256:2222222222222222222222222222222222222222222222222222222222222222
runtime receipt	sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc
migration hash	sha256:8888888888888888888888888888888888888888888888888888888888888888
runtime authority manifest	AUTHORITY-BILLING-01@sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
threat decision snapshot	TM-DECISION-01@sha256:abababababababababababababababababababababababababababababababab
monitor contract	MONITOR-CONTRACT-01@sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd
business readiness	BUSINESS-READY-01@sha256:9999999999999999999999999999999999999999999999999999999999999999
stage-0 gate snapshot	GATE-SNAPSHOT-00@sha256:0101010101010101010101010101010101010101010101010101010101010101
stage-1 gate snapshot	GATE-SNAPSHOT-01@sha256:0202020202020202020202020202020202020202020202020202020202020202
stage-2 gate snapshot	GATE-SNAPSHOT-02@sha256:0303030303030303030303030303030303030303030303030303030303030303
stage-0 incident query receipt	INCIDENT-QUERY-00@sha256:0606060606060606060606060606060606060606060606060606060606060606
stage-1 incident query receipt	INCIDENT-QUERY-01@sha256:0707070707070707070707070707070707070707070707070707070707070707
stage-2 incident query receipt	INCIDENT-QUERY-02@sha256:0808080808080808080808080808080808080808080808080808080808080808
stage-1 activation receipt	ACTIVATE-01@sha256:1414141414141414141414141414141414141414141414141414141414141414
stage-2 activation receipt	ACTIVATE-02@sha256:1515151515151515151515151515151515151515151515151515151515151515
last-known-good artifact	sha256:5555555555555555555555555555555555555555555555555555555555555555
evidence cutoff	2026-08-01T16:30:00+09:00

Synthetic accountable actors

Actor ID	Role and authority in this example
OWNER-BILLING-01	billing risk owner; may accept documented Low residual risk only
OWNER-SECURITY-01	security risk owner; reviews signature, tenant, and CI boundary
REVIEWER-01	human PR reviewer; may approve the exact review tuple for merge
OWNER-RELEASE-01	deploy/release/rollback authority for the named synthetic accounts and stated expiry only

TASK-billing-grace@1

• Outcome: 期限内に支払方法を回復できる顧客を即時停止せず、重複 ledger・重複通知・不正な再有効化を起こさない。
• Current behavior before prerequisite phase A: invoice.payment_failed の到着順で account row を直接 suspended にする。
• Prerequisite baseline: phase A で、旧挙動のまま全 event を compatibility writer の ledger/outbox へ通す、Evidence index 記載の full last-known-good artifact を既に配備済み。今回の rollback target はこの baseline である。
• Expected behavior: 正当な failure を初めて確定した時だけ 7 日の grace を開始し、canonical provider state が期限内に paid なら回復する。期限到達時は canonical version を再確認してから停止する。
• Non-goals: 税額、invoice 作成、provider retry schedule、通知本文、請求周期は変えない。
• Risk: R2。billing、tenant state、外部 event、期限 job、顧客アクセスに影響する。
• Maximum credible loss: 他 tenant の再有効化、重複 ledger/outbox/通知、未払い利用、正当顧客の誤停止。

Frozen acceptance criteria

AC	Contract	Evidence
AC-01	正しい署名の初回 failure で grace_started が一件だけ追加され、期限は provider effective time + 7 日	EVID-INT-01
AC-02	同じ provider event_id を 3 回受けても ledger と transactional outbox intent は各一件。sender は同じ effect idempotency key を使い、synthetic provider receipt と reconciliation で受理通知は最大一件	EVID-EFFECT-01
AC-03	success 後の古い failure、同時刻 event、provider version の逆転でも、再取得した canonical resource/version より古い event は account を戻さない	EVID-ORDER-01
AC-04	affected path inventory の全経路で、無効署名、別 tenant subscription、role/condition 不一致、不明 currency は state/effect を変えず監査 event を残す	EVID-AUTH-01
AC-05	ingress fence 後に queue を drain/quarantine し、flag を compatibility baseline へ戻すと新 reducer exposure は 0。ledger/outbox は保持し、最大 event lag 後の reconciliation が一致	EVID-RB-01
AC-06	grace expiry の T-ε / T / T+ε、expiry worker と success の競合、異なる請求周期でも、commit 直前の canonical paid/version が優先され、同じ account を二重停止しない	EVID-EXPIRY-01
AC-07	DB commit 後の ack 前、provider 受理後の receipt 永続化前、worker retry の各 crash window で outbox/effect が失われず重複もしない。未確定 effect は UNKNOWN として再照合する	EVID-CRASH-01
AC-08	state/schema consumer graph の全経路で、internal grace は tenant-scoped entitlement、cache、API serializer、旧 client contract と整合する。別 tenant は deny、旧 client へ未知 enum を露出しない	EVID-CONSUMER-01

Required unknowns: 0 for the synthetic merge/deploy decision。実 provider の障害・契約外挙動と顧客価値は未証明であり、customer exposure は別 decision の UNKNOWN のまま。

ADR-0042@1

Options

1. 変更前の status quo: arrival order で account row を直接更新。単純だが replay/逆順/監査/安全な rollback に弱い。
2. 最新 timestamp だけを account row に保存。比較はできるが、同時刻 tie、provider version、effect reconciliation、補償の説明力が弱い。
3. 二段階移行: phase A で legacy semantics も共通 compatibility writer の append-only ledger + transactional outbox へ通す。phase B の本変更で、provider effective time、canonical resource version、stable tie-break を使う reducer を flag 配下で有効化する。

Decision

Option 3 を採用する。署名検証、server-side subscription→tenant 対応、currency/policy validation、必要時の canonical provider resource 再取得を ledger insert 前に行う。ledger、projection、outbox は一 transaction、notification sender は stable effect idempotency key を使い、provider receipt と reconciliation で最終 effect を確認する。

• Invariant: arrival time ではなく canonical provider version/effective time と stable tie-break が状態を決める。
• Effect claim: internal intent は effectively-once に近づけるが、分散系で普遍的な exactly-once を主張しない。receipt が不明なら UNKNOWN として provider reconciliation を行う。
• Migration: table/index を expand、production-shaped rehearsal、phase A compatibility writer、phase B flag exposure、安定後に旧 direct-write code を削除する。
• Rollback: ingress fence と queue drain 後、flag で phase A semantics へ戻す。phase A も同じ ledger/outbox を使うため audit/idempotency boundary を迂回しない。
• Revisit: provider 追加、event contract 変更、月 10 万 event、reconciliation mismatch、max event lag 超過時。

TM-CHG-20260801-billing-grace@1

Baseline: TM-billing-system@7, hash sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd。

Acceptance scope DEPLOY-SCOPE-01 means exactly the full approved deploy-manifest and runtime-authority-manifest ID/digests listed in the Evidence index; it cannot expand a stage, cohort, ingress/effect capability, or expiry without a fresh gate snapshot and release approval.

Threat	Scenario	Prevent	Detect	Contain/recover	Evidence	Residual severity	Active?	Waivable?	State / acceptance policy, actor, scope, expiry, rationale, reopen
TH-01 critical	偽造 event で他 tenant を再有効化	raw-body signature、server-side mapping、write 前 tenant/currency validation	invalid-signature/tenant-mismatch metric、coverage heartbeat	handler fence、secret revoke、affected-account reconciliation	EVID-AUTH-01	Low	yes	yes	accepted_risk; RISK-POLICY@3, OWNER-BILLING-01, DEPLOY-SCOPE-01, 2026-08-08; canonical reconciliation bounds delayed detection; reopen on key compromise or tenant mismatch
TH-02 high	replay/crash window で ledger/outbox/通知が重複または欠落	event unique、transactional outbox、stable effect key、provider idempotency contract	duplicate-attempt、pending-receipt age、provider reconciliation	quarantine retry、correction notification if needed	EVID-EFFECT-01, EVID-CRASH-01	Low	yes	yes	accepted_risk; RISK-POLICY@3, OWNER-BILLING-01, DEPLOY-SCOPE-01, 2026-08-08; outbox/receipt reconciliation bounds uncertain delivery; reopen on duplicate effect or overdue receipt
TH-03 high	古い failure または同時刻 event が新しい success を上書き	canonical resource/version reread、effective-time reducer、stable tie-break	impossible-transition alert、daily state reconciliation	flag back、forward correction event、account review	EVID-ORDER-01	Low	yes	yes	accepted_risk; RISK-POLICY@3, OWNER-BILLING-01, DEPLOY-SCOPE-01, 2026-08-08; canonical reread bounds stale-event impact; reopen on impossible transition or provider contract change
TH-04 high	rollback 切替中に旧新 semantics が二重処理	ingress fence、single router、phase A/B 共通 compatibility writer/ledger/outbox	handler-version、queue watermark、duplicate-effect metric	drain/quarantine/replay、phase A artifact、ledger reconciliation	EVID-RB-01	Low	yes	yes	accepted_risk; RISK-POLICY@3, OWNER-RELEASE-01, DEPLOY-SCOPE-01, 2026-08-01T16:30:00+09:00; shared writer plus fence bounds switch overlap; reopen on max-lag breach, mixed handler, or duplicate effect
TH-05 medium	raw payload/log に決済個人情報	field allowlist、raw retention 24h、synthetic fixture	redacted-log test、forbidden-field scan	access restrict、affected-log deletion、credential rotation if needed	EVID-SEC-02	Low	yes	yes	verified; no separate acceptance under SEC-BASELINE@8; OWNER-SECURITY-01; reopen on forbidden-field detection, logging/config change, or retention breach
TH-06 high	expiry worker と success が競合し正当顧客を停止	per-account compare-and-swap on canonical version、commit直前 reread	conflicting-version/false-suspension alert	entitlement restore、forward correction、support notice	EVID-EXPIRY-01	Low	yes	yes	accepted_risk; RISK-POLICY@3, OWNER-BILLING-01, DEPLOY-SCOPE-01, 2026-08-08; compare-and-swap and correction bound the race; reopen on version conflict or false suspension
TH-07 high	既存 reader/cache/serializer が新しい grace を active/suspended/unknown と誤解し、越境・誤停止・旧 client 破壊を起こす	centralized tenant-scoped entitlement policy、exhaustive state match、versioned tenant cache key、public enum非変更	unknown-state/cache-version/old-client contract alert and audit	flag back、cache purge、projection correction	EVID-CONSUMER-01	Low	yes	yes	accepted_risk; RISK-POLICY@3, OWNER-BILLING-01, DEPLOY-SCOPE-01, 2026-08-08; exhaustive contract tests bound consumer mismatch; reopen on graph/enum/cache-policy change or unknown state

Authorization and state-consumer coverage

State/schema/event consumer graph AUTH-PATHS-billing-grace@sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee enumerates 7/7 changed or semantically affected reachable paths, including files with no diff.

Path	Identity/role × resource × operation × condition	Cases	Result/evidence
webhook handler	signed provider actor × mapped subscription/tenant × append/reduce × currency/version valid/invalid	4	covered by EVID-AUTH-01
expiry job	scoped service role × due account/tenant × suspend/no-op × canonical paid/version/race	4	covered by EVID-EXPIRY-01
outbox sender/reconciler	scoped service role × tenant/effect ID × send/reconcile × pending/accepted/unknown receipt	4	covered by EVID-EFFECT-01, EVID-CRASH-01
phase A/B router	release-controlled flag × tenant event × compatibility/new reducer × drain/rollback state	4	covered by EVID-RB-01
entitlement reader / API auth middleware	authenticated tenant × internal grace projection × allow/deny × before/at/after expiry	4	covered by EVID-CONSUMER-01
entitlement cache	tenant+account+projection-version key × hit/miss/invalidate × state transition	3	covered by EVID-CONSUMER-01
API serializer / old client	internal grace × stable public status/warning contract × supported client versions	3	covered by EVID-CONSUMER-01

Search、file、bulk、export、support impersonation paths are excluded because the hashed consumer/reference graph proves they cannot reach the internal entitlement state and the public event/status contract they consume is unchanged; “no file diff” was not used as evidence. Exclusion was approved by OWNER-SECURITY-01 at 13:39 and expires if the graph, state, schema, event, route, policy, or serializer contract hash changes.

CI/build privilege flow

No workflow file changed, but the release still consumes two privileged-flow-relevant jobs, so EVID-CI-01 records both.

Job	Trigger/ref trust and checkout	Runner/token/secret/network	Artifact handoff and target	Result
trusted build producer	push of protected merged main SHA; checkout exact SHA, never PR head under a privileged trigger	ephemeral hosted runner; contents:read; no secret/OIDC; dependency egress allowlist	produces signed provenance whose subject is the Evidence-index artifact digest and materials include source/lock/workflow hashes	PASS
publication/deploy consumer	environment-approved dispatch referencing the successful trusted build run and exact artifact digest; no untrusted checkout	ephemeral hosted runner; short-lived id-token:write, contents:read; no repository secret; registry/deploy API allowlist	verifies provenance/materials before deployment; target is the named environment in the deploy manifest; OWNER-RELEASE-01 environment approval	PASS

GATE-SUPPLY-CHAIN is Required=yes and PASS for EVID-CI-01. Any trigger, ref, runner, token/OIDC, network target, artifact producer, or environment-approval change invalidates it. N/A would be valid only if no privileged producer/consumer/deployer flow were used.

Blind spot: provider 自体の不正 response や長時間 outage は完全には防げない。canonical read と invoice/entitlement reconciliation、manual hold を残し、watermark 欠損時は expansion を UNKNOWN にする。

EVAL-CHG-20260801-billing-grace@1

Frozen plan and authoritative result

• Plan hash: sha256:3333333333333333333333333333333333333333333333333333333333333333
• Frozen before candidate run: 2026-08-01T11:00:00+09:00 by OWNER-BILLING-01 and reviewed by REVIEWER-01。
• Case set: synthetic JSON/clock/provider/old-client fixtures, 35 cases, hash sha256:4444444444444444444444444444444444444444444444444444444444444444。
• Oracle sources: signed provider fixture contract, frozen reducer state table, DB constraints, expected final provider receipt; implementation author did not edit the holdout expected outputs after freeze.
• Result source of truth: Evidence index 記載の full EVID-RUN-35 ID/hash; it owns exact commands, environment, start/end, exit, skipped/unknown, and raw artifacts.
• Gate: all 35 scheduled cases reconcile; every Critical/High case passes; unknown 0; consumer compatibility、migration、rollback drill pass.
• AI/action-ledger sections: N/A — deterministic non-agent billing code; tool-path scan EVID-AI-00 found no model or agent tool authority。

Segment	Scheduled / passed / failed / unknown	Evidence
signature/tenant authorization matrix	6 / 6 / 0 / 0	EVID-AUTH-01
duplicate/replay/outbox/provider crash windows	5 / 5 / 0 / 0	EVID-EFFECT-01, EVID-CRASH-01
reverse order/canonical version/same-time tie	4 / 4 / 0 / 0	EVID-ORDER-01
expiry T-ε/T/T+ε, billing-cycle and success race	6 / 6 / 0 / 0	EVID-EXPIRY-01
rollback/queue fence/phase A-B compatibility	4 / 4 / 0 / 0	EVID-RB-01
migration/concurrent write/partial restart/resource limit	5 / 5 / 0 / 0	EVID-MIG-01
entitlement reader/cache/serializer/old-client compatibility	5 / 5 / 0 / 0	EVID-CONSUMER-01
total	35 / 35 / 0 / 0	EVID-RUN-35

Gate result: SHIP for this synthetic code/config fingerprint. This does not predict a universal production failure rate, provider exactly-once, or customer value.

PR-184@synthetic

AC trace without result retranscription

AC	Implementation location	Authoritative evidence reference	Current for review tuple?
AC-01	src/billing/reducer.ts, migration	EVID-INT-01 inside EVID-RUN-35	yes
AC-02, AC-07	ledger/outbox/sender/reconciler	EVID-EFFECT-01, EVID-CRASH-01 inside EVID-RUN-35	yes
AC-03, AC-06	canonical version reducer/expiry worker	EVID-ORDER-01, EVID-EXPIRY-01 inside EVID-RUN-35	yes
AC-04	signature/mapping/job policy	EVID-AUTH-01 plus affected-path manifest	yes
AC-05	router/compatibility writer/runbook	EVID-RB-01 inside EVID-RUN-35	yes
AC-08	entitlement policy/cache/serializer/client contract	EVID-CONSUMER-01 inside EVID-RUN-35	yes

Review binding tuple hash is the source-tree/review tuple in the Evidence index. Its inputs include the full source tree, schema/config/tool-policy, and the full runtime-authority-manifest ID/hash from that index. REVIEW-01 records REVIEWER-01, the full source SHA, evidence manifest hash, review-rules version review-rules@5, time 13:50, and outcome approved; open veto findings 0. The review inspected signature-before-write, full affected consumer graph, canonical reread/tie-break, transaction/outbox crash windows, expiry race, phase A/B compatibility, migration rehearsal, and intended runtime authority.

At review time, merge/build/artifact/runtime links were PENDING; this did not block SHIP for merge. It did block deploy/release until RELEASE recorded the approved deploy and promotion manifests. Merge does not authorize production release.

REL-production-20260801-01

Migration rehearsal

• Contract: migration hash from the Evidence index; expand-only table/index plus compatibility writer. No historical backfill is required because only events received after phase A activation enter the new ledger; the unchanged preexisting entitlement projection is checksummed.
• Production-shaped synthetic input: 10,000 accounts, 25,000 subscription records, largest tenant 1,800 subscriptions, skewed event fan-out, 5,000 concurrent webhook/job writes. Fixture provenance and profile hash live in EVID-MIG-01.
• Boundary/concurrency: old/new app coexistence 10 minutes, duplicate/same-time events, lock contention, transaction interruption before/after DDL commit, idempotent restart.
• Result in authoritative manifest: pre/post account and entitlement checksums equal; ledger/outbox counts reconcile; max schema lock 38 ms, max replica lag 210 ms, disk headroom 68%; interrupted run resumed cleanly; phase A artifact remained compatible. No empty-table result was used as the sole gate.
• Backup/restore: synthetic snapshot SNAP-BILLING-20260801-01 was restored into an isolated database and its pre-migration checksums matched; rehearsal RPO 5 minutes and RTO 18 minutes against targets 5/20. The expand-only change normally uses forward repair, but catastrophic restore readiness was not marked N/A.
• Recovery: transactional DDL where supported; otherwise forward repair creates/checks missing index by hash. New ledger is retained; destructive down migration is forbidden.

Stage 0 deploy decision and binding

The approved deploy manifest binds the reviewed tuple, merged source tree, trusted build/provenance run, dependency/SBOM materials, artifact digest, migration hash, flag/config version, runtime authority manifest, intended target, and exposure 0.

The synthetic authority manifest fixes IaC/deployment spec billing-deploy@12, runtime identity svc-billing@12, IAM boundary iam-billing@9, DB role/RLS/grants billing-worker@7, secret IDs/versions webhook-signing@4 and provider-read@7 without values, external credential read/send scopes, and an egress allowlist limited to the provider API plus synthetic notification endpoint. It contains no wildcard tenant grant or general production-write credential.

FENCE-01 is a trusted upstream-control-plane receipt recorded at 13:54: candidate replicas are 0; the candidate webhook route, queue consumer, expiry cron, startup effect hook, and notification credential are disabled; existing traffic remains on phase A. The sole exception is migration EVID-MIG-01, run by the separately approved db-migrator@5 identity against the named schema/hash. Customer exposure 0 was not used as a substitute for this effect fence.

Gate	Required	Result source/state at stage 0
GATE-AC	yes	Evidence-index EVID-RUN-35; PASS
GATE-REVIEW	yes	REVIEW-01 + Evidence-index review-tuple hash; PASS
GATE-THREAT	yes	Evidence-index TM-DECISION-01; residual High/Critical 0, required Low acceptances current; PASS
GATE-EVAL	yes	Evidence-index EVID-RUN-35; PASS
GATE-MIGRATION	yes	EVID-MIG-01, including restore/reconciliation evidence; PASS
GATE-ROLLBACK	yes	EVID-RB-01, current through 16:30; PASS
GATE-OBS-READY	yes	Evidence-index MONITOR-CONTRACT-01; PASS
GATE-SUPPLY-CHAIN	yes	EVID-CI-01; PASS
GATE-AUTHORITY-INTENDED	yes	Evidence-index AUTHORITY-BILLING-01; PASS
GATE-BUILD-BIND	yes	EVID-BIND-01; PASS
GATE-EFFECT-FENCE	yes	FENCE-01; candidate ingress/effect surfaces disabled, migration exception exact; PASS
GATE-RUNTIME-BIND	no before deploy	N/A — receipt cannot exist pre-deploy; OWNER-RELEASE-01, 13:55, stage 0 only
GATE-ACTIVATION-BIND	no before first activation	N/A — candidate remains suspended and no activation receipt can exist; OWNER-RELEASE-01, 13:55
GATE-ACTION	no for these synthetic stages	N/A — fake notification provider, outbound production effect disabled; OWNER-RELEASE-01, 13:55
GATE-INCIDENT	yes	Evidence-index INCIDENT-QUERY-00, query at 13:55, open invalidating incidents 0; PASS

Evidence-index GATE-SNAPSHOT-00 hashes the stage-0 row artifacts and states above. APR-DEPLOY-01 by OWNER-RELEASE-01 at 13:56 binds that snapshot, the approved deploy manifest, suspended deployment mode, FENCE-01, the named production-like test target, exposure/effect ingress 0 except the named migration, and expiry 14:10. Derived decision: SHIP for suspended deploy only.

The candidate is deployed suspended. Its actual deployment/authority receipt at 14:00 reports the expected artifact, migration, config, flag-off state, target, runtime identity, IAM/DB policy hashes, credential IDs/versions/scopes, and egress policy, while FENCE-01 remains active. EVID-RUNTIME-01 and EVID-AUTHORITY-01 verify the receipt against the deploy manifest and create the runtime promotion manifest in the Evidence index. A missing or mismatched receipt would have kept all ingress disabled and release at UNKNOWN; privilege broadening or an unapproved cross-tenant/write target would have been STOP.

Staged release/exposure approvals

• Evidence-index GATE-SNAPSHOT-01 at 14:02 hashes current GATE-RUNTIME-BIND (EVID-RUNTIME-01), GATE-AUTHORITY-DRIFT (EVID-AUTHORITY-01), GATE-TELEMETRY-LIVE (versioned live snapshot under MONITOR-CONTRACT-01), GATE-BUSINESS (Evidence-index BUSINESS-READY-01), GATE-INCIDENT (Evidence-index INCIDENT-QUERY-01, open invalidating incidents 0), plus current threat/eval/rollback gates. GATE-ACTION is Required=no only for the fake provider and disabled outbound production effect, recorded in this snapshot with actor/time/reason.
• APR-REL-01: OWNER-RELEASE-01 at 14:03; binds GATE-SNAPSHOT-01 and the runtime promotion manifest to stage 1, two named synthetic accounts in one synthetic tenant, only filtered webhook/queue/expiry plus fake-provider effect capability, and expiry 15:30.
• Evidence-index ACTIVATE-01: trusted control-plane receipt at 14:04 under APR-REL-01; actual filters are exactly the two approved accounts/one tenant, enabled surfaces/capabilities and controller/policy versions match, and all other candidate ingress remains fenced. GATE-ACTIVATION-BIND PASS before canary events are counted.
• Evidence-index GATE-SNAPSHOT-02: fresh check at 15:34; all pre-activation gates required to authorize stage 2 are current, including unchanged promotion/authority, threat/eval, EVID-RB-01, live telemetry, business readiness, canary maturity, and Evidence-index INCIDENT-QUERY-02 with open invalidating incidents 0; PASS. GATE-ACTIVATION-BIND remains pending until the next receipt.
• APR-REL-02: fresh event at 15:35; binds GATE-SNAPSHOT-02 and the unchanged promotion manifest to stage 2, five named internal test accounts across two synthetic tenants, the same explicitly filtered webhook/queue/expiry plus fake-effect capability, and expiry 16:30.
• Evidence-index ACTIVATE-02: trusted control-plane receipt at 15:36 under APR-REL-02; actual filters are exactly those five accounts/two tenants, enabled effect capabilities are unchanged, controller/policy versions match, and all other tenants/surfaces remain fenced. GATE-ACTIVATION-BIND PASS before limited-stage events are counted.

Stage	Customer scope and effect ingress	Start condition	Success	Stop
suspended deploy	customer exposure 0; candidate webhook/queue/cron/effect credential fenced; named migration only	stage-0 gates + FENCE-01 + APR-DEPLOY-01	runtime/authority receipt matches while fence remains	fence failure, autonomous effect, migration/runtime mismatch
canary	2 synthetic accounts / 1 synthetic tenant; only filtered webhook/queue/expiry/fake-effect scope enabled	GATE-SNAPSHOT-01 + APR-REL-01 + ACTIVATE-01	expected ledger/state/effect receipt and telemetry coverage complete	any tenant mismatch, duplicate effect, unexpected suspension, missing watermark
limited	5 internal accounts / 2 synthetic tenants; same explicitly filtered effect surfaces	canary mature + GATE-SNAPSHOT-02 + APR-REL-02 + matching ACTIVATE-02	reconciliation exact, effect pending age 0, coverage complete	any invariant failure, telemetry gap, authority drift, open incident

Rollback and in-flight work

• Recovery mode: mixed — config/code reversible, append-only data forward-preserved, a real notification would be externally irreversible and need correction.
• Ingress fence: disable new reducer route and pause expiry scheduler; OWNER-RELEASE-01 owns the action.
• In-flight: wait the documented two-minute maximum event lag; drain safe transactions, quarantine unacked webhook/outbox items by event/effect ID, then replay through the phase A compatibility writer.
• Config/code: flag to phase A and, if needed, restore exact last-known-good artifact digest from the Evidence index. Phase A still writes the shared ledger/outbox.
• Partial rollback: compare handler version, queue watermark, event/effect IDs, account projection, and provider receipts; forward-correct any divergence.
• Verification: new reducer exposure 0, queue/quarantine disposition complete, ledger/outbox/provider receipts reconcile after max lag. EVID-RB-01 recorded synthetic recovery in 104 seconds against a five-minute target.
• External effects: no real email or charge exists in these synthetic stages. Customer exposure would require real-provider effect verification and correction/refund/communication ownership before approval.

Telemetry coverage and synthetic observation

Stage	Expected / observed event records	Watermark and heartbeat	Versions	Missing	State
canary	8 / 8	event-time lag 12 s; collector and authority-drift heartbeat current	producer billing@18, schema evt@4, monitor bill-guard@6, authority manifest current	0	PASS
limited	20 / 20	event-time lag 18 s; both heartbeats current	same immutable versions and authority hash	0	PASS

At 15:30, canary exposure was 2/2 accounts, expected state 2/2, duplicate external effects 0, pending receipts 0, tenant mismatch 0, reconciliation delta 0, and telemetry coverage 8/8. This verifies the stage procedure, not a customer-value or universal reliability rate. The original authority expired, so the next state was PAUSE until APR-REL-02.

At 16:30, the limited synthetic stage reached 5/5 accounts with its 20/20 expected event records, reconciliation delta 0, and no invalidating incident. Further forward exposure is PAUSE because the known approval-expiry blocker outranks missing evidence. Real-provider/customer-value evidence maturity remains UNKNOWN because this infrastructure change alone does not prove improved payment recovery.

Final observation event OBS-DECISION-01: decision hold, derived state PAUSE, actor/time OWNER-RELEASE-01 / 16:30, evidence GATE-SNAPSHOT-02 + telemetry rows + reconciliation receipt; residual limitation is no real-provider/customer-value evidence; follow-up TASK-billing-grace-real-provider-validation; reopen only with matured evidence, all current gates, and a fresh manifest/scope/effect-bound approval.

Traceability audit

• Every AC-* maps to an evidence item inside one authoritative run manifest: yes.
• Threat baseline has an immutable version/hash; every High/Critical row has prevent/detect/recover, evidence, named actor/scope/expiry/rationale, and residual risk below High: yes.
• Changed and semantically affected authorization/effect/consumer paths scheduled/covered are 7/7; exclusions invalidate when the graph or contract hash changes: yes.
• Eval plan/oracles were frozen before the candidate run: yes.
• PR review uses the full source SHA and exact review tuple; review rounds are append-only: yes.
• Deploy manifest is approved before deploy; actual receipt creates a separate promotion manifest before exposure: yes.
• Migration uses nonempty production-shaped data, concurrency, old/new compatibility, resource checks, partial restart, and forward repair: yes.
• Notification safety uses outbox, stable effect ID, crash-window tests, receipt/reconciliation; it does not claim universal exactly-once: yes.
• Rollback fences ingress, accounts for in-flight work, and returns to a ledger-compatible phase A writer: yes.
• Telemetry expected/observed counts, watermark, heartbeat, versions, and coverage distinguish zero failures from missing data: yes.
• Production value is not inferred from synthetic canary health: yes.
• No real secret, customer, payment, or production data appears: yes.