Keep balance-drift recovery inside the Delivery outcome-correction UI

Current state

The operator confirmed that Delivery lesson les_019eb8a4-2631-7473-b1d9-18f683519fd8 did not happen on June 19, 2026. Its current Canceled outcome with reason Bad Weather is correct and must remain unchanged. Delivery will not apply the previously previewed Canceled-to-Completed correction.

The preview still exposed a real Revenue projection defect. On the latest preflight, Revenue account crd_acct_019e4271-ad00-756f-8af8-2dcbde2b9575 was active with a stored balance of 16 credits, while its spendable ledger balance was two credits across eight qualifying entries. One active reservation held two credits. Revenue must re-derive these values again inside the guarded repair transaction rather than treating this memo snapshot as a write target.

The defect is already blocking a separate legitimate correction. Delivery lesson les_019fc370-207b-78e5-82bf-b1e17a62ca17, stored at July 10, 2026 6:40 PM Central, is Completed and needs correction to Canceled with reason Client Canceled. Revenue preview loc_019fc38f-10fe-736e-8e25-b938fe1bf935 correctly reports a positive two-credit adjustment, four post-correction credits, two available credits after the active reservation, and covered reservation requirements. Apply is disabled solely because of stored_ledger_balance_drift.

The abandoned preview created no Revenue correction, ledger entry, recognition row, reservation change, or Delivery outcome change.

Delivery prevention

Delivery found a separate local duplication path while investigating the blocked workflow. After the original lesson was marked Canceled, the historical scheduling form ignored the exact canceled match and created reservationless lesson les_019fc377-e0f2-7e9e-9ce2-1f978f43e12b for the same Person, coach, site, lesson type, and June 19 window.

Delivery is preserving the accidental row as audit history, classifying it explicitly as a duplicate, and changing the historical scheduling path so an exact terminal match cannot create a second lesson. The original Canceled lesson and its released Revenue reservation remain authoritative.

Operator recovery proposal

The operator should not have to leave Delivery or ask Revenue to repair a safely reconcilable projection before every correction. Delivery has therefore proposed ADR-0040.

When an outcome-correction preview is blocked only by stored_ledger_balance_drift, the Delivery drawer will offer an explicit Repair credit balance and retry action. Revenue will own the authenticated operation, re-derive the spendable ledger balance transactionally, verify the preview-bound account and expected stored and ledger values, update only the stored balance projection, append an audit marker, and return reconciled or noop. Delivery will then request a fresh preview. It will never enable Confirm from the stale preview.

The action will not add, remove, or rewrite ledger entries, reservation states, recognition rows, or lesson outcomes. Any additional blocker, changed account fact, ambiguous account, or failed audit check will leave the correction blocked. Revenue must also repair the source projection-update defect and monitor drift, because operator recovery is a safety valve rather than the normal balance-maintenance path.

Asks

Revenue, please:

1. Reconcile the stored balance projection for account crd_acct_019e4271-ad00-756f-8af8-2dcbde2b9575 to the current authoritative spendable ledger using the existing guarded, idempotent repair. Preserve all ledger and reservation history and append the repair audit marker.
2. Identify and repair the projection-update path that left this account at 16 stored credits while the spendable ledger reached four, so the same drift does not block another legitimate correction.
3. Review ADR-0040 as the financial owner. Confirm the preview-bound reconciliation operation, serializable and optimistic checks, audit marker, idempotent replay, workload authorization, and no-ledger-mutation invariant.
4. Reply with guarded repair evidence, a production ledger audit, and a fresh blocker-free preview for correction of lesson les_019fc370-207b-78e5-82bf-b1e17a62ca17 from Completed to Canceled with reason Client Canceled. No lesson correction preview or apply is requested for June 19.

Platform, please review ADR-0040 for workload scope, auditability, and the additive correction API amendment. If approved, publish the accepted contract change after Revenue and Delivery agree the exact request and response.

References

• ADR-0038: adrs/ADR-0038-guarded-lesson-outcome-corrections.md
• ADR-0040 proposal: adrs/ADR-0040-delivery-ui-revenue-balance-reconciliation.md
• Previous Delivery balance-drift incident: 2026-07-30-delivery-outcome-correction-balance-drift-blocker
• Previous Revenue guarded repair: 2026-07-30-revenue-balance-drift-repaired-and-correction-applied
• Correction API sub-spec: contracts/credit-reservation-lock/lesson-outcome-correction-api-proposal.md