Skip to content
Specifications
SPEC-PROD-001: Attendance Interval Eligibility and Payroll Correction

SPEC-PROD-001: Attendance Interval Eligibility and Payroll Correction

Reference Number Version Effective Date Supersedes Authority Level
SPEC-PROD-001 1.4 2026-10-03 1.3 Normative technical contract; incorporated authority only

I. Purpose

Define reproducible interval eligibility, original-settlement provenance, and bounded compensation without rewriting attendance or financial history.

II. Scope

Completed attendance intervals within one class and target seat; payroll settlement, interval invalidation, and residual correction. This incorporated contract authorizes owning-domain reconstruction and atomic correction implementation. It authorizes no historical backfill or compatibility bridge.

III. Authority Level

This technical contract binds only through explicit incorporation by DOM-PROD-001 and FEAT-PROD-003 / FEAT-PROD-005. It does not independently authorize mutations. INV → DOM → FEAT governs; higher-level conflicts stop implementation. Cross-domain composition belongs solely to the FEAT contracts; the owning domains neither import nor invoke one another.

IV. Dependencies

V. Interval Identity and Terminal Eligibility

PROD pairs one opening active event with its corresponding closing inactive event in its canonical ordered timeline. Identity is (class_id, target_seat_id, opening_event_id, closing_event_id). Both rows belong to that class and target, form the completed pair selected by PROD, and satisfy canonical class-day boundaries. An arbitrary pair, an open interval, or an end preceding its start is ineligible for this operation. A legitimate zero-duration completed pair is allowed.

PROD derives credited seconds through canonical elapsed duration; invalidation changes only compensation eligibility. Original scans, credited duration evidence, and current attendance state are preserved and remain inspectable. Invalidation is terminal: it cannot be edited, reversed, deleted while its target exists, or converted into a new payable interval. Paid work remains historically settled, including after correction or reversal; it never re-enters unpaid work.

attendance_interval_invalidation is the append-only PROD-owned decision record. Required fields are id, class_id, actor_seat_id, target_seat_id, opening_event_id, closing_event_id, recorded_at (UTC), reason_code, idempotency_key, correlation_id, receipt_json, lineage_event_id, lineage_token (64 characters), and lineage_version. Business fields are frozen at INSERT. Audit linkage is opaque and excluded from the protected payload; all three fields initialize together exactly once in the creating transaction, whose commit requires matching complete creation evidence. Late attachment, replacement, partial linkage and missing evidence fail closed under DOM-PROD-001 §XI.4 and the Operations creation protocol. Reasons are exactly INVALID_ATTENDANCE, NON_WORK_ACTIVITY, or DUPLICATE_PARTICIPATION; no unrestricted notes are accepted or persisted. Unique interval identity prevents a second invalidation under any key. Command identity is (class_id, FEAT-PROD-005, idempotency_key).

Source-event references are within PROD. class_id and seat references are shared anchors; other-domain internal rows are referenced only through opaque locators. The protected-row audit pointer is the narrowly mandated linkage of INV-ARC-016, not a general permission for cross-domain foreign keys.

VI. Original Settlement Provenance and Cent Allocation

Each new payroll settlement freezes its complete interval membership in payroll_event.summary_json: opening/closing event IDs, credited seconds, governing policy_uuid, original per-minute pay_rate, and allocation_version = 1 (including the version-1 quantization convention). Existing setting-share and scheduled-occurrence provenance remains present. References are scoped to the event’s class and target. Policy UUID is an opaque non-FK locator; no subsequent rate lookup may reprice settled work.

Persist source inputs, not allocated amounts: no earnings cache, payroll amount column, or monetary amount in PROD summary JSON is introduced. PROD owns frozen participation, original pricing facts, settlement membership, and eligibility conclusions. FEAT supplies those proven inputs to Ledger; Ledger performs monetary allocation/correction arithmetic and validates it against its original posted credit. Ledger must never discover or reinterpret attendance intervals, select payroll policies, or resolve business eligibility itself.

For each governing setting, retain the original pricing rule: total credited seconds × original per-minute rate ÷ 60, quantized once to cents using exact decimal/rational arithmetic, nearest cent with ties to even (ROUND_HALF_EVEN) for allocation version 1. Do not round interval durations or separately quantize interval earnings. Historical reproduction must establish the original quantization contract rather than infer it from today’s default.

Let a setting’s quantized share be integer cents C and its interval seconds be s_i, summing to S. Allocate floor(C × s_i / S) cents to each interval, then distribute the remaining cents one each in descending order of fractional remainder. Resolve equal remainders by ascending closing-event UTC timestamp, then ascending opening-event ID, then ascending closing-event ID. This ordering is canonical, not query order. Exact rational arithmetic prevents floating-point ties. If S = 0, C must be zero and every allocation is zero; nonzero C with S = 0 is an integrity failure. Negative credited seconds or a negative original payroll credit fail integrity validation.

Allocation sums must equal each original setting share, and setting shares must sum to the original posted payroll credit. Corrections reuse the full original allocation, never reallocate cents among surviving intervals. A zero-cent interval may be invalidated with no Ledger effect or correction payroll row.

Historical payment correction uses complete immutable-source reconstruction under §VI.1–2, or modern frozen membership and exact creation evidence. PROD establishes unique original-rule membership and retained original pricing; Ledger establishes original credit, exact replay/allocations and complete compensation. Proximity or matching totals alone cannot establish those facts. Missing actual provenance or conflicting evidence denies the entire paid invalidation; absent newly introduced fields alone does not reject recognized legacy reconstruction. No historical row is rewritten, no command reservation or lineage is fabricated, and no compatibility bridge is authorized.

VI.1 Historical business membership reconstruction

DOM-PROD-001 §XV.9 and DOM-LED-001 §IX.3 incorporate SPEC-PROD-002 §VI.1 for supported historical membership reconstruction. Complete immutable attendance under the original payroll window, retained versioned original settings and recognized original writer/temporal rules determine membership; exact Ledger replay-paid aggregate must equal the uniquely bound original credit. An original signed selection snapshot, new allocation fields or retroactive audit linkage is not required merely because the current workflow records it. Two conflicting source selections or rate assignments cannot be resolved by selecting whichever amount matches. Known contradictory integrity evidence denies.

Historical attribution version 1 is a newly derived pure calculation distinct from prospective recorded allocation_version = 1. Preserve original per-share operation order/context/truncation/quantization: ad957 divides rate by 60 at precision 28/HALF_EVEN before multiplication, while modern frozen allocation uses its recorded modern rule. Use exact selected-duration weights grouped by pair before rational largest remainder and canonical closing UTC/opening ID/closing ID ties. Conserve original share and credit cents; never reallocate after corrections.

Missing old lineage is reported as coverage metadata; it does not upgrade an original row’s lawfulness. Ledger returns separate reconstruction evidence, never fake CreationEvidence. Modern frozen business and v2/v3 monetary sources retain complete strict creation requirements and cannot fall through to legacy handling. New correction decisions and effects acquire current full lawful lineage. Original histories and signatures are untouched.

VI.2 Historical multi-payment attribution graph

This graph reconstruction is incorporated by DOM-PROD-001 §XV.10, DOM-LED-001 §IX.4 and FEAT-PROD-006/005/003. It extends the reconstruction to original fragments/remainders and recognized positive incident top-ups. Historical graph attribution version 1 identifies the new derived graph allocation contract below, separately from both historical attribution version 1 (§VI.1) and prospective settlement allocation_version = 1. No allocation is claimed to have been recorded by a historical writer. No graph table, proof cache, adoption command, replacement historical signature or migration is authorized. The pure reconstruction and existing atomic correction interfaces are explicitly authorized by their governing contracts.

A. Complete original business graph

PROD owns a class/target-scoped graph connecting completed canonical pair identities to every original business contribution and original settlement boundary relevant to them. A contribution is an originally selected UTC subsegment of a canonical interval: an open-at-payroll fragment, a later clipped remainder, a completed whole-pair contribution, or a separately identified positive incident top-up loss component. A still-open canonical interval cannot be invalidated. Its eventual canonical closing event may postdate an original fragment payment. Reconstruct the original payroll-window selection from the complete immutable timestamp-ordered sources under the recognized original rule; a later close assigns the historical subsegment to today’s completed canonical pair and is not inserted into the earlier selection. Canonical pairing and unique source continuity establish that identity, rather than timestamp proximity or a separately demanded original visibility snapshot. Preserve full raw pair duration separately from the original selected/truncated pricing duration; repeated-active restart follows the recognized original rule, while the completed pair retains its canonical continuation identity.

Each contribution identifies the original PROD event and window, canonical opening/closing IDs, selected subsegment endpoints, original rule/writer assignment, original policy/share assignment, the complete immutable original-window source set. Zero-value payroll events and every intervening payroll boundary remain in the ordered business timeline; they can change a later window even when absent from incident corrected_event_ids. They do not invent zero-cent Ledger credits. Manual credits/top-ups remain non-boundary events. PROD establishes historical membership; it never discovers membership from a monetary total or computes attributable cents.

The graph must be closed over all connected contributions, events, shares and original positive credits, including other intervals sharing an event or top-up. A later modern frozen membership does not replace earlier historical participation for the same pair; mixed histories use the complete graph while retaining strict proof for every modern contribution. Complete bounded immutable source-window selection under the recognized original rule, retained configuration, incident references and uniquely matched Ledger aggregates establish the reconstruction. The complete relevant source set must be read; totals or incident IDs alone are insufficient. Cap exhaustion, ambiguous ordering/graphs, missing actual writer/configuration inputs or changed evidence deny the entire graph; never qualify a convenient subset. Missing separately signed historical visibility alone is no longer a denial. Existing fixed invocation bounds in SPEC-PROD-002 §V cover the complete graph before any page slice; pagination cannot divide its proof.

PROD identifies same-domain source references; Ledger independently binds each positive original credit through its own immutable class/target/account/mechanism/actor and original-business linkage evidence. Opaque Ledger origin locators are stable and versioned, not randomized presentation tokens or internal cross-domain FKs. Every original credit belongs to exactly one proven originating business event; multiple positive credits require independently proven per-credit share partition, never a proportional split guessed from their amounts. Unrelated teacher manual credits are not attendance contributions. The 79 observed PROD-PAY-001 source references are candidates, not an allowlist or proof of unique top-up membership.

B. Ledger-owned allocation and exact conservation

Ledger receives immutable PROD-owned graph membership/rule inputs, Policies-owned original settings and Operations-owned canonical evidence through FEAT. It validates monetary identity and exact original pricing before deriving allocations. Preserve each writer’s original selection, duration aggregation, whole-second truncation, arithmetic operation order, decimal context and per-window/per-setting quantization. In particular, floor/truncate of an aggregate is not replaced by the sum of individually truncated fragments. The original integer pricing seconds and newly derived exact duration weights are distinct quantities.

For an ordinary proven original credit, reproduce each original setting/window share’s integer cents once under its independently assigned original descriptor. Within that share, group all selected subsegments belonging to the same canonical pair; the pair’s weight is their proven exact elapsed duration, represented in integer microseconds or exact rational seconds. Reject duplicate edges and conflicting overlapping selection claims; grouping is not permission to count the same original subsegment twice. Do not independently round component durations or component earnings. Allocate that share’s original integer cents proportionally to these weights by exact rational largest remainder. Equal remainders sort by ascending canonical closing UTC, opening-event ID, then closing-event ID, independent of input order. A zero-weight pair receives zero; positive share cents with zero total weight is an integrity/unavailable evidence failure, not an allocation to a guessed pair. Shares sum exactly to their original credit; pair allocations never change after another pair is invalidated.

For a proven positive PROD-PAY-001 incident top-up, preserve the original positive window deltas separately. The source descriptor at ad9574334d72fd92cc93402e851ab0ebc22aaad9, app/services/payroll/corrections.py:build_class_correction_proposal, computes each included legacy window’s delta as the original quantized whole worked-seconds price minus the separately quantized replay-paid-seconds price; a window is included only when worked seconds exceed paid seconds and the delta is positive. Preserve the exact source operation order, rate selection, decimal context and quantization; do not price aggregate unpaid seconds at today’s/latest rate or combine windows before rounding. The recognized original incident summary and linked credit must select this pinned descriptor unambiguously; a caller may not choose it by claim or matching amount alone. Original summary amounts are historical observations, not Ledger monetary authority; validate every window delta against the proven original credit. Do not execute the retired writer.

For each included original top-up window, independently prove the complete original worked and replay-paid selected subsegments and their unique canonical-pair assignment. Require each pair’s uniquely proven replay-paid temporal subsegments to be a subset of its proven worked subsegments within that original window. Form their nonoverlapping temporal set difference before summing exact durations; the grouped duration is the pair’s loss weight. Paid-outside-worked segments, duplicate edges, conflicting overlapping claims or ambiguity in the temporal set membership deny attribution even when scalar durations match. These are new read-only rational duration weights, not a claim of historically stored integer per-pair seconds. The original writer’s whole-second worked and paid aggregates are replayed separately; do not require or manufacture equality to the sum of individually floored loss weights. Negative loss weight, conflicting overlap, ambiguous loss assignment, or a positive delta with zero total loss weight denies attribution. Zero loss weight receives zero. Apply largest remainder with the same canonical pair tie order to that window’s proven positive delta. Sum its derived allocations exactly to the original window delta, and all original window deltas exactly to the positive top-up credit. If an original top-up total matches but its loss components cannot be proven, attribution remains unavailable.

A positive top-up is a new original credit, never negative compensation and never a reduction of an earlier credit’s cap. One interval may legitimately have allocations on several original fragment/remainder/top-up credits. Recover all proven contributions once per origin; do not omit a legitimate top-up merely because it concerns seconds also described by an original fragment. Conversely, duplicate edges or splitting one pair into several components must not create extra rounding positions or count a credit cent twice. Require conservation independently for every original share/window and credit, and for the complete graph. No amount is added to PROD summary, receipt or attendance rows.

C. Prior compensation and later execution boundary

Ledger proves every original credit’s complete prior compensation, including accepted pending and posted principal effects, under its strict modern creation evidence or separately validated legacy reconstruction contract. Funding legs have zero attribution. Missing modern version-specific evidence denies; legacy absence of new columns cannot imply zero. A legacy reversal needs its original business reference, unique scoped monetary counterpart and exact original full magnitude, not an unsigned pointer alone. A proven full reversal or complete residual recovery of an origin makes all its remaining interval contribution zero. Partial compensation requires uniquely proven attribution to this graph’s canonical pair/contribution identities; a known aggregate recovered total does not identify which pair was compensated. Never subtract the same unknown partial recovery from every interval, cap an arbitrary interval at the aggregate remainder, or invent a proportional allocation. Ambiguous partial attribution denies the entire paid invalidation, even where a separate per-credit residual command can prove its aggregate remainder.

For each origin c, Ledger derives C_c original credit cents, A_i,c fixed allocation to interval i, and attributable prior interval recovery R_i,c. For qualified partial attribution, require 0 ≤ R_i,c ≤ A_i,c and complete conservation between attributed prior principal effects and the origin’s proven total recovery. The interval’s proposed recovery is the sum over all origins of A_i,c − R_i,c, except an origin proven fully recovered contributes zero. Each original credit also retains the independent cap 0 ≤ total accepted recovery ≤ C_c. A full/residual origin recovery absorbs all remaining contributions only when its complete provenance proves that disposition; no unrelated negative entry can do so. Complete graph reconstruction or strict modern evidence, scoped posting admission and prior compensation remain required even for zero-cent or fully recovered eligibility-only outcomes.

FEAT-PROD-005 composes the reconstruction directly through owning-domain interfaces, without executing FEAT-PROD-006. Lock target seat → ClassEconomy → every original credit in stable locator order → monetary sources. Revalidate complete graph/preview/caps/balances, resolve combined funding once and use one reservation for every origin principal and protection leg. Each origin has its own immutable recovery principal/intent and cap. Full/residual/interval commands serialize together. Missing/changed evidence or any failure rolls back eligibility, receipt, business corrections, monetary effects, reservation and audits together. Terminal eligibility, accepted replay, no correction fee and original cycle/Interpretation preservation remain binding. Existing invalidation receipt JSON records complete opaque original-business/origin/result locator sets, with reconstruction bound by expected-preview identity and canonical request digest, without financial amount or cached earnings; new fields are protected as part of the existing complete JSON payload.

D. Current worked acceptance requirements

All examples require unique original-rule reconstruction over complete immutable source/configuration inputs, exact Ledger aggregate equality, scoped posting and complete compensation; modern records additionally require strict creation evidence. Numeric consistency alone cannot choose ambiguous membership.

Scenario Required graph conclusion
Recognized original v1 credit exactly matches original-window replay, but no new membership/allocation/compensation columns were recorded Derive fixed attribution through separate reconstruction evidence; preserve original coverage/signature, and create only a newly audited correction. Missing modern fields alone do not deny.
An original linked envelope has an actual HMAC/chain/scope contradiction INTEGRITY_FAILURE; no correction or eligibility-only commit, regardless of matching arithmetic.
Modern frozen business or version-3 credit lacks required canonical creation evidence Deny; no legacy reconstruction fallback.
One completed A has fragment credit 3 cents, later remainder credit 2 cents and a positive incident top-up of 1 cent, all uniquely attributable A’s fixed contributions are 3+2+1=6 cents across three origins; a later qualified invalidation recovers 6 once, with respective caps 3/2/1. The top-up is a positive credit, not prior recovery.
One original share is 5 cents over three equal exact-duration pair weights Allocate 2/2/1 by canonical tie order. Splitting the first pair into two source subsegments still gives 2/2/1 because grouping precedes allocation.
Original aggregate duration is 1.2 seconds, from two 0.6-second fragments of different pairs, with a proven 1-cent original share Preserve original whole-second aggregate 1 (not 0+0); new weights are 0.6/0.6, allocating 1/0 in canonical order.
One positive incident credit contains window deltas 3 and 2 cents; first window loss weights A:B=2:1, second window belongs wholly to B Allocate first window 2/1, second 0/2; A gets 2, B gets 3, and total stays 5. Never reprice their combined unpaid seconds or omit the second window.
Zero-valued payroll event lies between two source events but is absent from corrected-event IDs Keep its boundary in original window derivation; no synthetic credit. Omitting it denies completeness.
Original active-row restart or payroll-while-open fragment is now within a completed pair Require exact original selected subsegments and restart/window rules; today’s completed pair alone does not prove old fragment membership.
Two graphs use different source pairs but reproduce identical cents Deny unique attribution; equal totals do not select a graph.
A credit’s A/B allocations are 2/3, and one proven earlier terminal interval recovery targeted A for 2 cents A is already invalidated and cannot be invalidated again; B’s fixed contribution remains 3. Residual origin recovery is 3; combined recovery is exactly 5.
Same 5-cent credit has known total prior recovery 1 but its target contribution is unknown Entire paid interval invalidation is unavailable; never allocate the unknown cent pro rata. A separate residual operation still requires its own aggregate proof/authority.
One of A’s three origins is proven fully reversed or completely residually recovered That origin contributes zero new recovery; other proven origins retain their fixed contributions. If all origins are fully recovered, eligibility-only invalidation needs complete proof and recovers zero.
Missing top-up membership, per-credit split, ambiguous original-window source selection, pending original credit or one unavailable compensation origin Entire paid action remains PROVENANCE_UNAVAILABLE; no partial eligibility/recovery. Current diagnostic observations remain inspectable.
Duplicate graph edge, equal-time ambiguous boundary, evidence cap exhaustion or one original share fails credit conservation Fail closed before a positive graph result; no query-order choice or truncated proof.
Target seat or class is lawfully destroyed Existing business and monetary records disappear under their existing lifecycle contracts; no new graph record/cache/archive survives. Actor provenance alone cannot remove another surviving target’s evidence.

These are acceptance obligations, not runtime tests executed by this documentation package. Test genuine original writers/evidence separately from synthetic graph assumptions; preserve original signatures and current v2/v3 interfaces. Concurrent multi-origin recovery and injected-failure tests are required for the current reconstruction integration.

VII. Compensation, Replay, and Concurrency

An unpaid interval produces only its invalidation and audit record. A paid interval produces its invalidation, a correction payroll business event when money is recovered, Ledger compensation effects/reservation, and audit lineage atomically. Correction summary carries same-domain original_payroll_event_id, correction_intent = INTERVAL_INVALIDATION, invalidation ID, source-event IDs, and opaque correction_intent_locator and Ledger origin locator; no financial amount is stored there.

Ledger owns immutable compensation_origin_locator, nonnegative compensation_amount_cents, and correction_intent_locator on its monetary effects. Only actual recovery is attributable compensation; savings/checking transfer legs contribute zero. For each original credit, full reversal plus interval and residual compensation must not exceed that credit. Ledger validates and serializes the aggregate cap. PROD must not infer remaining recoverable money by adding payroll rows.

Exact full reversal is allowed only while the original credit is uncompensated. After partial compensation, FEAT-PROD-003 uses a distinct residual correction: original credit minus all attributable prior compensation. Its summary has correction_intent = RESIDUAL_RECOVERY and original-event/intent provenance. It is neither a partial REVERSAL nor a VOID. Already fully recovered payments permit later eligibility invalidation with zero additional monetary recovery. Missing or inconsistent recovery history fails closed.

Corrections and reversals do not advance payroll windows, scheduled occurrences, payroll-cycle completion, or economic-cycle boundaries. Neither invalidation nor recovery rewrites completed Interpretation materializations.

Preview is a pure domain-query composition: interval eligibility, settlement evidence, authoritative proposed compensation, protection transfer, and resulting balances. Its identity covers every fact affecting confirmation. For a new command, serialize and revalidate the preview before mutation; any changed relevant fact returns PREVIEW_CHANGED without writes. Successful exact replay resolves the existing command and compares the original supplied request fingerprint before current-preview evaluation; it returns the original result even though the action itself changed eligibility or balances. Same key with changed actor, target, pair, reason, or preview identity returns REPLAY_MISMATCH. A different key for an already-invalidated pair returns ALREADY_INVALIDATED without recovery.

The immutable protected receipt_json stores expected_preview_identity, fingerprint_version, canonical_intent_digest, original_settlement_disposition, and opaque_outcome_locators. It contains no monetary amounts, personal notes, or cached earnings. It permits reconstruction of the original accepted result through owning-domain queries without evaluating today’s eligibility or balances. New unpaid/zero-value commands use the invalidation record and receipt as the durable PROD result; monetary commands also follow Ledger reservation identity (class_id, feat_code, idempotency_key) under SPEC-LED-002. Do not expand that namespace by target, account, amount, or effect type.

Payroll settlement and invalidation share serialization for (class_id, target_seat_id) before eligibility selection. If invalidation commits first, payroll excludes the interval; if payroll commits first, invalidation observes paid membership and requires a refreshed paid preview before compensation. Reversal and all corrections also serialize against the original Ledger credit and current account settlement. Every required business row, monetary effect, reservation, and audit emission commits together or rolls back together.

VIII. Funding and Lifecycle

For a correction debit, Ledger resolves the shared protection rule using Class Configuration’s supplied current banking directive: when checking would be negative, transfer the entire shortfall from savings only if protection is enabled and savings can cover it completely. Otherwise savings remains untouched and checking takes the full debit, including below zero. Own-account transfers retain their separate sufficient-funds rule. Corrections incur no NSF fee, obligation, or deferred deduction.

Target-seat destruction removes its invalidations and source business records under existing lifecycle authority; class destruction removes all class-scoped records. Removing a provenance actor does not authorize removal of another surviving target’s records. Lifecycle destruction is the sole deletion exception, not an invalidation operation. Audit handling follows its existing immutable-chain and lawful-destruction contracts; do not invent a retained business archive or new audit deletion path.

IX. Worked Acceptance Examples

Scenario Required result
Unpaid A is invalidated before payroll Append decision; preserve both scans; A is excluded from future settlement.
A=$10, B=$15, C=$20 settle as +$45; invalidate B Preserve +$45; append −$15 with B/original-payment lineage; net +$30.
Then invalidate A Append −$10; total recovery $25, remaining original contribution $20; B cannot recover again.
Then request whole-payment recovery Distinct residual correction −$20; total recovery exactly $45; no partial reversal.
Payment was already fully reversed or residually recovered Later interval invalidation records eligibility; zero additional recovery.
Three 20-second intervals at $0.05/minute Quantized setting share is 5 cents; equal remainders allocate 2,2,1 cents using canonical tie order; invalidating the last recovers 1 cent, with no reallocation.
A legitimate zero-duration interval Allocate zero; append invalidation without a monetary effect or payroll correction row.
Exact retry with original preview identity Return original result and effects without additional inserts, despite changed current state.
Same key but changed reason or pair REPLAY_MISMATCH; original result unchanged.
New key for same invalidated pair ALREADY_INVALIDATED; no second compensation.
Invalidation wins concurrent payroll Payroll sees ineligible work and omits it.
Payroll wins concurrent invalidation Unpaid preview is stale; deny PREVIEW_CHANGED, then refreshed paid preview can recover its allocation.
Concurrent corrections/reversal on one $45 credit Serialized Ledger cap permits combined recovery of at most $45; stale confirmations fail.
Checking $2, savings $3, debit $10, protection enabled Shortfall $8 cannot be covered entirely; savings stays $3, checking becomes −$8; no correction fee.
Checking $2, savings $12, debit $10, protection enabled Transfer $8 atomically; checking becomes $0, savings $4; recovery attribution counts $10 only.
Checking $2, savings $12, debit $10, protection disabled No transfer; checking −$8, savings $12.
Own-account transfer exceeds source funds Existing insufficient-funds denial remains; charge/deduction overdraft rule does not apply.
Teacher or pair belongs to another class Scope denial; no reads outside authorized class and no writes.
Historical credit lacks provable original membership or allocation PROVENANCE_UNAVAILABLE; neither invalidation nor correction commits.
Audit emission, reservation, or posting fails midway Full rollback leaves no invalidation, payroll correction, reservation, or partial funds transfer.
Target seat or class is lawfully destroyed Remove dependent business records under existing lifecycle authority; no retained earnings archive.

IX. Amendment

Version 1.3 (2026-10-03) separately defines conditional historical graph attribution (§VI.2) without widening §VI.1 or changing current receipts/writers. Supersedes future-only graph design scope, not original-evidence, monetary execution or signature requirements; no persistence is introduced.

Version 1.2 (2026-10-03) defines conditional historical priced whole-pair business proof and distinct derived historical attribution. It supersedes no monetary proof gate and does not claim original allocation was recorded.

Version 1.1 (2026-10-03) completes the invalidation linkage schema/protocol without changing the terminal eligibility or recovery rules.

Version 1.0 establishes the incorporated contract authorized on 2026-10-03. It replaces the exclusive whole-payroll-reversal correction rule only through the amended governing DOM/FEAT contracts. Revisions increment version, effective date, and supersedes; preserve invariant hierarchy, original history, monetary ownership, and deterministic reproduction.

Edit canonical source on GitHub

Last updated: 2026-10-03

SPEC-OPS-001: Reversal, Void, and Transaction Finality SpecificationSPEC-ECON-002: Economic Policy Visibility and Disclosure