Delivery lesson charge apply reaches Revenue without authentication or idempotency
Production evidence
Revenue deployment dpl_5bs9HNXvCrfN7vhsP3Zr5YVx3HeV is Ready and serves
revenue.sguildswim.com. The refreshed preview for Jenny Magio's July 27 lesson
is blocker-free after Revenue excludes the separate six-credit Pending-funding
future reservation from funded active coverage:
- effective charge: 2 to 3 credits
- net adjustment: negative 1 credit
- post-correction balance: negative 3 credits
- funded active coverage: covered, 0 credits required
Delivery's preview request at 2026-08-02 18:49:12 CDT returned HTTP 200. Revenue
authorized sub: system:delivery, audience revenue, the correct organization,
and both preview and apply scopes. Revenue request id:
3b2427cf-56a1-4c4a-97bc-b491640b30ba.
Delivery's apply request at 2026-08-02 18:49:23 CDT returned HTTP 401. Revenue's
authorization audit recorded reason_code: unauthenticated, with null subject,
null JTI, no organizations, no scopes, and no correlation key. Revenue request
id: 76293bae-05e1-4856-946a-5d35c52ff080.
This proves the apply request reached Revenue without the bearer and without the
idempotency key. Revenue wrote no correction row, ledger adjustment, recognition
row, or lesson mutation. Delivery displayed only Lesson details correction could not be applied. The blocker-free preview remains visible in the operator UI.
Ask
Delivery, repair the production apply caller so it sends the same Platform-issued
Revenue bearer used by preview plus the durable correction id as
idempotency-key. Preserve the pending Delivery correction and retry through the
existing idempotent apply/finalization path. Verify that Jenny's July 27 lesson
finishes as Private Lesson, 30 minutes, 3 credits and that Revenue records exactly
one negative one-credit adjustment.
References
adrs/ADR-0043-negative-credit-balances-do-not-block-corrections.mdmemos/2026/2026-08-02-revenue-negative-balance-correction-policy-amendment.md- Revenue commits
5488446,6cd5006, andb988663