Revenue accepts ADR-0040 and repairs the Corrigan balance projection

Revenue accepts ADR-0040 as the financial owner. Delivery remains the operator surface, and Revenue remains the sole writer of the credit-account projection. Platform has approved the workload-identity architecture and the dedicated revenue.lesson-outcome-corrections.balance-reconcile scope, subject to the accepted contract being published and the policy being deployed.

Production repair

Revenue re-derived the account inside a serializable transaction immediately before writing. Account crd_acct_019e4271-ad00-756f-8af8-2dcbde2b9575 had a stored balance of 16 credits and an authoritative qualifying-ledger balance of two credits across eight entries. One open reservation held two credits. Revenue updated only CreditAccount.balanceCredits from 16 to two and preserved every ledger, reservation, recognition, lesson, and correction row. Immediate replay returned noop with the same ledger facts.

The June 19 lesson and its weather-released reservation were explicit exclusions and remain unchanged. Revenue did not preview or apply a June 19 correction. Revenue also did not apply the July 10 correction.

After repair, Revenue generated a fresh preview for correction loc_019fc38f-10fe-736e-8e25-b938fe1bf935. It has no blockers, returns a positive two-credit adjustment, projects four credits after correction and two available credits after the active reservation, and reports that active-reservation coverage remains satisfied. Delivery must still obtain its own fresh preview before allowing confirmation.

The production ledger audit scanned 357 entries and found zero append-only violations.

Source prevention and reconciliation operation

Revenue repaired the lesson-consumption path that posted LESSON_DEBIT without advancing the stored balance projection. Both reservation-backed and legacy reservationless consumption now update CreditAccount.balanceCredits in the same transaction as the ledger write.

Revenue also deployed the ADR-0040 operation:

• POST /api/v1/lesson-outcome-corrections/reconcile-balance
• required scope: revenue.lesson-outcome-corrections.balance-reconcile
• request: organization_id, correction_id, opaque preview_token, and operator_id
• response: result (reconciled or noop), credit-account id, stored balance before and after, authoritative ledger balance, and as_of

The operation accepts only a preview whose sole blocker is stored_ledger_balance_drift. It re-resolves the preview-bound organization, lesson, reservation, Person, and account; re-derives the ledger balance, entry count, open-reservation total, and account version; and performs the projection-only update in a serializable transaction. A durable audit row records the preview-token hash, correction and operator identity, expected and observed balances, ledger facts, account version, correlation id, workload subject, and workload jti. The opaque preview token and bearer token are not logged.

Replay is idempotent. Changed preview-bound facts fail without mutation. A successful reconciled or noop result invalidates the old preview for apply purposes, so Delivery must discard it and request a fresh preview.

Implementation commit: 401f341 (feat(revenue): add guarded balance reconciliation). The production deployment is ready. The unauthenticated production route returns 401, confirming that the operation is present and fails closed before Platform publishes and deploys the exact workload policy.

Remaining rollout gate

Broad enablement remains gated on Platform publishing and deploying the accepted scope and contract, Delivery wiring the button to this endpoint, and Delivery and Revenue validating the complete repair, fresh-preview, and operator-confirm flow once under controlled production conditions. The Corrigan balance repair is complete, but the July 10 outcome correction remains an operator confirmation in Delivery.

Verification

• focused lesson-consumption and lesson-outcome-correction suites: 24 tests passed
• TypeScript typecheck: passed
• dispatcher smoke: eight envelopes across eight event families passed
• production append-only ledger audit: 357 entries scanned, zero violations
• reconciliation audit migration: present in the production Revenue schema

References

• ADR-0040: adrs/ADR-0040-delivery-ui-revenue-balance-reconciliation.md
• Delivery request: 2026-08-02-delivery-corrigan-credit-balance-drift-prevention
• Platform acknowledgment: 2026-08-02-platform-adr-0040-balance-reconciliation-ack
• correction sub-spec: contracts/credit-reservation-lock/lesson-outcome-correction-api-proposal.md