[scbrown]

Retained obsolete firings need an explicit expiry decision without delivering them or rewriting their history. Add an immutable row-hash disposition ledger, a reviewed offline plan/apply CLI, and an identity fence across delivery, binding, receiver setup, budgets, wakeups, renewal, recovery selection and metrics. Recovery adjudication remains separate.

Plans select only undisposed eligible rows. Exact replays include their own receipts, allowing successive cohorts while preserving original rows, old receipts, conflict refusal and population-drift checks. Read-only first planning also works before the ledger schema is installed. Older consumers require the delivery hold before rollback.

Validation: the successive-cohort regression reproduced the old refusal and now passes; 18 focused controls and the full 757-test suite plus 46 subtests pass under the HOME guard (163 paths and five UID resources unchanged). Ruff passes. Complete CI and one independent review of this head remain required. No production expiry or runtime acceptance is claimed.

Recorded before/after delivery behavior. The recording uses synthetic fixtures; successive-plan behavior is covered by the executable regression in test_outbox_disposition.py.

[scbrown]

CHANGES at 0eaa255

[P2] Exclude prior dispositions when building a later expiry population — emitter.py:998-1002 and 905-910. Disposed originals deliberately remain undelivered, unbound and never attempted, so both population queries select them again. After plan A expires old event E1, plan B for a later cutoff cannot expire new event E2: selecting only E2 raises exact reviewed population changed; including E1 and E2 raises conflicting append-only disposition because E1's receipt binds plan A. Thus a successful first operation permanently prevents subsequent expiry batches for the same emitter/cutoff range without editing retained evidence.

Independent two-cohort fixture reproduced both refusals; the existing ledger remains intact with one row. Please distinguish already-disposed identities from new eligible work in plan/population validation while preserving exact original-plan replay, immutable receipts, genuine conflicting decisions, population-drift refusal and all-or-nothing append. Add a two-successive-plan regression (first replay, later new cohort, replay both; originals and old receipts unchanged). No source edits by reviewer.

Review scope: all nine changed paths, required README/release/CI contexts and consumer-lease/delivery/setup/binding/budget/wakeup/renewal/recovery/migration interactions. Exact head has seven terminal successful checks; native packet complete, reviewer arnold/non-author, base64e4845 green. Native risk63603c8986e7e599144e600f543c92cd8e3fce93e2e932a8e0772f73f09324a6; prepared content0b24124a2e28576d74b161c4e6f97242a29b66b1bbd1182d1a74ad6e60580fb4. Independent targeted suite97PASS+14subtests/7.01s, HOME163paths+5resources CLEAN. Independent second-plan reproducer also guarded/CLEAN. Existing demo correctly labels synthetic source behavior. No other blocking finding established.

This is a source review only. Runtime remains held: representative full-reactor/adapters/aggregate-resource/hold-aware rollback acceptance, Root pin/hold release and historical recoveries are separate. No apply, sink, production state, Cargo, or private corpus action by reviewer. Same Arnold review reservation retained for corrected head; no second reviewer needed.

[scbrown]

APPROVE — SAME Arnold non-author re-review, Chaski PR72 exact ca353f8, author Malcolm. Original P2 successive-cohort blocker is corrected; no remaining blocking source finding after all nine changed paths and complete required CI/release/README contexts.
The shared population selector excludes any prior disposition when creating a new plan and includes only the identical plan digest during replay. Explicit prior-receipt conflict checks remain; every original row hash, exact scope/count/cutoff population, recovery refusal and atomic append transaction remain enforced. Read-only first-plan inspection handles a legacy database without creating a ledger. Delivery, setup, budget, wakeup, recovery, renewal, metrics, startup verification and supported key migration retain the disposition fence; expiry is not a delivery receipt.
Independent scoped suite:132 tests PASS+18 subtests PASS (61.19s). Independent reproduction of the original two-cohort defect now passes: two successive plans, both exact replays stable, original rows/receipts unchanged, conflicting decisions and later population drift refuse without ledger change. Final HOME guard outcomes recorded separately before native verdict attachment. No source edits.
Exact head independently seven terminal SUCCESS. Ordinary classify refusal on later release base retained; normal supported current-helper1449 diff-bound classify T2 record589c8d30d367e0e93653e4447c0f5fca8d926e38f1fb461bc83b9b754d02c741 and complete native packet e2d39ed95da178777b878f0bba584671507feca0ba2ffe4258330419bd0eeccb admit unchanged content against current green6d0c8db7f3bda977d1f29448acf4403594798bcc. Only release0.7.0 metadata separates currentbase from integrated40d1122. Landing requires normal current gates and merge --diff-bound; author/lead retain landing custody.
Source review only. Full reactor/adapters/aggregate-resource and hold-aware inverse rehearsal, Root exact live pin/hold release and separate historical recovery adjudication remain open. No live apply, sink delivery, replay, cursor/DB mutation, Cargo or runtime authority inferred.

Final guard acceptance: BOTH commands exit0 and HOME163 watched paths+5 UID-keyed resources CLEAN. Original P2 source finding resolved by independent observed regression; no remaining blocking findings.

NATIVE ATTACHMENT STOP: actual durable approval msg-ca1ff7d584c2f55c122d delivered; current-helper review-record --lead-receipt exited2 REFUSED receipt read is not valid JSON. Native accepted approval remains absent; source APPROVE alone does not lift earlier CHANGES/native merge veto. No legacy fallback, resend, alternate reviewer or manual merge. Source acceptance capture arnold-df7h-ca353-two-cohort-regression-resolved-independent-source-approve-20261114 tx1234152 verified reader/task link; native attachment outcome is this separate refusal.