[Mjones13]

An admitted child-result delivery could fail before provider start, then be marked delivered and disappear from its parent’s completion cohort. ETS-B v4 retains the claimed results and reserves one held successor when every attempt has complete, positive refusal proof.

The Jones-owned service records new-attempt eligibility, durably closes it before post-prefix work across repeated outbox executions, and certifies only the four explicit refusal reasons inside the successful terminal settlement transaction. Migration 154 adds sparse Jones metadata with no upstream foreign keys or payload changes. Successor reservation revalidates the live cohort, exact generation/message/task set, and complete attempt proof in its transaction.

Every completion offer and message admission honors the keyed hold. A fresh Codex provider-turn running event with a non-null native reference, from a different attempt born after the hold, can arm one release. The dispatch-lock subscriber revalidates the cohort and probes existing continuity/control admission before consumption and offer; the start prefix remains authoritative. Replays and startup do not release held/armed work, Stop/acknowledgement/supersession void it, and consumed crash recovery uses the same message identity. Certification exposes the scoped in-transaction observer for the separate ETS-P lane.

Silent gate clearance without another accepted run remains a visible manual hold. Drivers outside the source-proved Codex allowlist also remain manual. Restart admission is omitted from the read-only probe because its evaluator mutates in-memory holds; the existing start prefix still enforces it. Notification/history exclusion is preserved. ETS-P and the other #898 residuals remain separate.

Validation: 631 tests passed in 17 focused files after forward integration, before the migration-identity-only adjustment to 154, including the new module, the three shared services and their orchestration/runtime suites, migration/upstream-isolation checks, and provider notification/history coverage. After allocating ID 154, all 252 migration/new-module/runtime checks passed in seven files; the final Codex null-reference-to-accepted sequence was then checked directly and passed (other cases deliberately filtered in that one follow-up invocation). Server typecheck passed with the official Effect-patched launcher; changed-file lint and formatting passed; fresh strict Jones boundary checks report zero violations; git diff --check passed.

The deterministic failing-before test completed a child, admitted its result delivery, and invoked the real start service with control admission held: the prior finalizer cleared the cohort. The retained-successor assertion passes with this change. Coverage includes all offer callers, direct admission, all four reasons, stale CAS and transaction/observer rollback, captureStartFailure exclusion, same-attempt prior crossing, missing/legacy/unknown/native evidence, crash boundaries, reconstructed held/armed state, re-refusal generations, fresh/replayed acceptance, probe re-hold, Stop/ack races, and notification/history exclusion.

Scoped unused-export audit has no new findings; it reports the unchanged productionSpawnIntent and productionSpawnResult exports in ProducerFinalizer.ts (identical blob to the base). The normal repository commit hook’s format/lint/Knip task passed.

Forward-integrates canonical main including PR974 (be20c60). Fresh overlap inspection found the known shared hooks in #961/#690, runtime/loader/isolation and manifest overlap in #972, and manifest-only overlap in #975/#965/#979 and A’s #978 registrations. #972 now claims migration 153; this PR moved its additive migration to the next free ID, 154. A’s existing native-goal-controls registrations are unchanged by B. Integration remains through normal forward merges with fresh boundary qualification.

Refs #898. Source-only; no installed-runtime or live-user-state changes.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}