# Reservation validation record

Reviewed 25 October 2026. This is a local private teaching package for fictional Cedar Teaching Bank. Video delivery is a scene script; no rendered video or remote publication is asserted.

## Contract and arithmetic

The approved Stage 2 reservation proposal and shared availability contract govern this package. All money is exact canonical minor-unit strings; Python integers, TypeScript BigInt and PostgreSQL numeric preserve the arithmetic. The local pinned journal core makes reproduction independent of sibling imports. The settlement-payable liability is an explicit Stage 2 chart extension; Stage 1 files were not changed.

Independent expected cases verify the complete hold decomposition and the balance bridge:

| Transition | Posted | Effective hold | Available |
|---|---:|---:|---:|
| Reserve 30000 | 97600 | 30000 | 67600 |
| Capture 12000, retain | 85600 | 18000 | 67600 |
| Final capture 10000, release 8000 | 75600 | 0 | 75600 |

Final decomposition is `30000 = 22000 captured + 8000 released + 0 remaining`. Capture moves the held deposit liability to settlement payable; release is not a financial debit. These are synthetic author-derived expectations, not observed customer records.

## Portable implementation

`python -B tests/run_parity.py` passed **54 scenarios / 98 complete actions**, including strict TypeScript compilation and full transition/state/result/reason/nullability equality. Expected arithmetic and decisions are independently declared in the fixture. Assertions also check unchanged caller state, immutable history prefixes, exact component sums, versions and separate counters.

Coverage includes retained/final/full capture, exact exhaustion, one unit beyond capacity, positive and huge exact amounts, malformed money/types/booleans, duplicate and conflicting identities, retry before changed clock/version/account/period checks, stale versions, release, one millisecond before expiry, equality and delayed worker, journal identity collision and invalid-journal rollback. Snapshot models establish deterministic committed outcomes; they do not establish actual transaction isolation or durability. Raw receipt: [parity results](../tests/parity-results.json).

## Actual PostgreSQL 18.1 profile

`python -B tests/run_postgresql.py` passed **23 named acceptance groups**. The runner creates a generated-credential SCRAM-authenticated child cluster on loopback port 55431, verifies its exact data directory and `fsync=on`, `full_page_writes=on`, `synchronous_commit=on`, then stops/removes only that child. The raw result confirms `existing_services_used=false` and `child_stopped_and_removed=true`. Existing PostgreSQL services and production databases were untouched.

Real independent authenticated sessions use a READY barrier and observed `pg_blocking_pids` before releasing the first transaction. This verifies actual lock contention rather than two sequential calls labeled concurrent.

- PG00–PG04 verify restricted login/settings and independent reserve/partial/final arithmetic, including original capture replay with no second journal.
- PG04b exports the actual first three committed journals and accounts under the ledger lock, with an independently read `ledger_heads.last_sequence=3` and a trusted first archive-observation receipt after earlier acknowledged commits. The head is not inferred from row count or maximum sequence. [Observed export](../examples/committed-journal-export.json).
- PG05–PG06 deliberately stage a hold projection update before journal validation rejects a closed period. Hold, journal, accepted identity, version and both counters roll back; the failed identity is reusable by a corrected retry.
- PG07–PG10 verify duplicate reserve, competing reserves for scarce capacity, capacity restored by rollback, and duplicate capture creating exactly one journal.
- PG11–PG15 verify stale/over-capture rejection, capture/release races in both orders, processing time read after a real lock wait, and capture accepted before expiry completing once despite a later expiry contender.
- PG16–PG20 verify accepted replay before changed account/period policy, direct-write/private-helper/raw-posting denial, authorization before stored-result disclosure, changed-command conflict and original result recovery after controlled restart.
- PG21 moves each trusted journal/hold recording watermark into the future under owner-controlled test setup. A current snapshot and a new operation reject `RECORDED_TIME_REGRESSION`; original accepted replay still works. Each watermark is restored. No operating-system clock is changed.

The actual partial/final [current snapshot exports](../examples/availability-partial-snapshot.json) are compatible with the separate availability reader; the [final export](../examples/availability-final-snapshot.json) has posted and available 75600 with zero remaining. Root independently accepts these through the A04 Python/TypeScript reader and coordinates the writer-to-journal-replay integration. These current snapshots do not reconstruct earlier hold states. The full journal export only asserts availability from its first trusted archive observation, not earlier physical COMMIT times.

Raw receipt: [PostgreSQL results](../tests/postgresql-results.json). Self-contained SQL: [pinned base](../implementations/sql/postgresql18-base.sql) and [reservation extension](../implementations/sql/reservation.sql). SQL returns the original stored result directly or raises an exception; portable reducers additionally label committed/replayed/rejected. Semantic guarantees are aligned without claiming identical wire envelopes.

## Visual and interactive acceptance

`node tests/build_lab.cjs` bundles the actual TypeScript journal/reservation model and stamps SHA256 `9577d98f9ccd872f342032d061aa6f8ce827bdb1f45c5ba37552ae128f515ef5`. `node tests/browser_qa.cjs` checks that hash, exact displayed values, all five scenarios, retained/final first-capture selection, transport controls, keyboard, reset, scenario timer cancellation, reduced-motion one-step behavior, large integers and zero console errors. It checks 390/768/1440 widths for no document overflow and minimum 44 px controls.

The static bridge, lifecycle Mermaid, commit Mermaid and article Mermaid are rendered. The lifecycle avoids a self-loop label collision by stating partial-capture retention inside the active state. Screenshots and the visual acceptance notes are in [visual QA](../visuals/QA.md); raw automated receipt is [browser results](../tests/browser-results.json). Local standalone QA is separate from root's visitor/iframe integration acceptance.

## Limits and release gate

Exact expiry equality is a deterministic portable test; SQL observes actual processing before/after expiry. Controlled restart does not simulate hardware power loss. The owner/bootstrap boundary, unrelated posting authorities, independent archival retention, replicas and production throughput remain outside these checks. External privileged debits can create negative availability; this product does not conceal it.

Official platform/provider facts are bounded by [references](../REFERENCES.md). Product policy is an explicit teaching choice; arithmetic is author-derived; database outcomes are locally observed. Historical case: **not useful**.

Final structural validation passed: `validate_topic_package.py --mode full` reports 12 Markdown files, **0 errors / 0 warnings**; `validate_playground.py` reports **1 playground passed / 0 failed**. All six exposed SQL/evidence/validation copies were checked byte-identical to their canonical files. Publication remains private; root's independent visitor acceptance is the next integration gate.