fix(outbox): classify lease expiry from the database clock

CHANGELOG.md

@@ -59,6 +59,7 @@ All notable product and architecture changes are recorded here. Releases use imm
 
 ### Fixed
 
+- Outbox delivery-lease expiry recovery now classifies liveness from the PostgreSQL clock, so a future caller timestamp cannot steal a still-live exclusive lease.
 - Scoring results now reject non-canonical engine-artifact digests and accept only `sha256:` followed by 64 lowercase hexadecimal characters as immutable provenance.
 - Exact replay of an already accepted response event remains idempotent after collection pauses or closes, while conflicting replay evidence still fails closed and genuinely new responses remain restricted to active sessions.
 - Documentation status drift that still described protected-main `item_delivery`, participant linking, authorization, and integration domain primitives as Target after their merge.

docs/TRACEABILITY.md

@@ -132,7 +132,7 @@ Still-Target logical modules/adapters include remaining product aggregate persis
 
 ### Active implementation work that is not protected-main truth
 
-**Active PR** #76 data-rights processing-start persistence is not protected-main truth until an unchanged reviewed/check-clean head is integrated. Identity-verified requests persist an immutable operation identity and processing-start time under `FOR UPDATE` so later lifecycle composition cannot race the classified row. Dependent-system execution remains outside this slice.
+**Active PR** #60 exclusive outbox delivery-lease persistence is not protected-main truth until an unchanged reviewed/check-clean head is integrated. Pending outbox rows accept one fenced worker lease, recover expiry from the database clock without transferring the fence, reject a future caller timestamp that would steal a still-live lease, and reject stale or zero-window claims. Live side-effect execution remains outside this slice.
 
 ## 5. ADR traceability by concern
 

docs/architecture/AS_BUILT_SCHEMA.md

@@ -2,7 +2,7 @@
 
 - Status: Normative evidence map
 - Date: 2026-08-14
-- Protected-main baseline: `4b828134f4d597ca1add3d6dbf02bebd72bfb0b2`
+- Protected-main baseline: `cc5850a0d1eacbbf16d03075534fce460a8286e6`
 
 This document records which portions of the logical ERD have executable PostgreSQL migrations and adapters. It does **not** promote active-PR DDL or target entities to protected-main truth. `ERD.md` remains the normative logical model; this file is the physical/as-built maturity companion required once migrations exist. Status terms follow `docs/TRACEABILITY.md`: **Implemented** means evidence exists on the named protected-main baseline, **Active PR** means evidence exists only on an open PR, and **Target** means required behavior not yet implemented on that baseline.
 
@@ -12,18 +12,34 @@ Protected main contains executable PostgreSQL 18 persistence subsets for integra
 
 | Physical object | Logical ownership | Protected-main maturity |
 |---|---|---|
-| `integration_outbox` | integration | Implemented subset |
+| `integration_outbox` | integration | Implemented subset; exclusive delivery-lease extension is **Active PR** #60 |
 | `integration_delivery_attempt` | integration | Implemented subset |
 | `integration_inbox` | integration | Implemented subset |
 | `scoring_job_state` | scoring | Implemented subset |
 | `instrument_release` | instrument publication | Implemented subset |
-| `integration_consumption` | integration | **Active PR** #58 (not protected-main truth) |
+| `integration_consumption` | integration | Implemented subset |
 
 The protected-main integration identity is source- and tenant-scoped. A physical implementation must continue to preserve the stronger logical tenant/resource, replay, and crash-safety invariants in ADR-0014 and ADR-0015.
 
-## Active PR inbox-consumption physical schema
+## Active PR outbox delivery-lease physical schema
 
-PR #58 (`feat/inbox-consumption-persistence-20260814`) `migrations/0012_integration_consumption.sql` and `src/postgres_inbox_consumption.rs` adapter persist one consumption work item for an existing `integration_inbox` receipt. The slice is **Active PR**, not protected-main truth. It stores pending/processing/completed/quarantined evidence, a monotonically increasing fencing token, a time-bounded processing claim, a durable `side_effect_ref`, and optional completion or quarantine evidence. Receipt-only inbox rows remain uncompleted. A processing claim cannot be stolen by another worker. Expire-and-reclaim returns an expired claim to pending without transferring the crashed worker's fence.
+PR #60 (`feat/outbox-delivery-lease-20260814`) extends the protected-main `integration_outbox` relation through `migrations/0013_outbox_delivery_lease.sql` and `src/postgres_integration.rs`. The extension is **Active PR**, not protected-main truth.
+
+The active slice adds:
+
+- nullable `lease_worker_ref` and `lease_ref` opaque ownership references;
+- nullable positive `lease_fencing_token` and `lease_expires_at_unix_ms` values that are either all present or all absent for the current lease;
+- `delivery_lease_generation BIGINT NOT NULL DEFAULT 0 CHECK (delivery_lease_generation >= 0)` as the persisted monotonic generation;
+- `integration_outbox_fencing_generation_check`, requiring any live `lease_fencing_token` to equal the current persisted generation;
+- exclusive pending-row claims, explicit expired-lease recovery, and fenced attempt recording that clears the current lease after an accepted attempt;
+- database-clock authority for both worker-side lease-expiry classification and exclusive-lease recovery, while caller-supplied attempt timestamps remain immutable delivery-attempt evidence and a future caller observation cannot steal a still-live lease;
+- fail-closed stale fencing before replay classification whenever a current lease exists, while exact replay after a completed attempt has cleared its lease remains idempotent.
+
+Real PostgreSQL evidence on the active PR is carried by `tests/postgres_outbox_delivery_lease.rs`, `tests/postgres_outbox_delivery_lease_fencing_integrity.rs`, `tests/postgres_outbox_delivery_lease_authority.rs`, `tests/postgres_outbox_delivery_lease_concurrency.rs`, `tests/postgres_outbox_delivery_lease_coverage_edges.rs`, and `tests/postgres_outbox_delivery_lease_migration_isolation.rs`. These tests cover exclusive claim/recovery, monotonic fencing, invalid physical state rejection, database-authoritative expiry, rejection of a future caller timestamp against a still-live lease, stale-fence replay precedence, blocking-proven concurrent claims, schema isolation, and persistence failure paths. The slice must remain **Active PR** until the exact reviewed/check-clean head is merged and protected main is refetched.
+
+## Protected-main inbox-consumption physical schema
+
+`migrations/0012_integration_consumption.sql` and `src/postgres_inbox_consumption.rs` persist one consumption work item for an existing `integration_inbox` receipt. This is an **Implemented subset** on protected main after #58. It stores pending/processing/completed/quarantined evidence, a monotonically increasing fencing token, a time-bounded processing claim, a durable `side_effect_ref`, and optional completion or quarantine evidence. Receipt-only inbox rows remain uncompleted. A processing claim cannot be stolen by another worker. Expire-and-reclaim returns an expired claim to pending without transferring the crashed worker's fence. Subsequent claim-deadline columns from later inbox-expiry slices remain documented with those slices.
 
 ## Protected-main scoring-job physical schema
 

docs/architecture/ERD.md

@@ -384,6 +384,11 @@ erDiagram
       string payload_digest
       timestamp occurred_at
       timestamp published_at
+      string lease_worker_ref
+      string lease_ref
+      int lease_fencing_token
+      timestamp lease_expires_at
+      int delivery_lease_generation
     }
 
     integration_delivery_attempt {
@@ -428,7 +433,7 @@ The target ERD deliberately includes several logical entities that are not yet p
 - `consent_ledger` and `consent_event` persist the already-merged `src/consent.rs` append-only ledger. Physical persistence is carried by Active PR #49 (`migrations/0005_consent_lifecycle.sql`); HTTP consent transport and derived snapshot tables remain Target.
 - `participant_identity_link` is the persistence target accepted by ADR-0020. The current `src/participant.rs` `keyverse_subject_ref` field is an application-domain first-link projection, not the future mutable persistence source of truth.
 - `longitudinal_enrollment`, `longitudinal_observation_record`, and `temporal_analysis_submission` make the ADR-0008 Commons-owned Gyeot/TEPP orchestration boundary explicit. No TEPP analytical kernel is duplicated here.
-- `integration_outbox`, `integration_delivery_attempt`, `integration_inbox`, and `integration_consumption` reflect `src/integration.rs` domain semantics. Outbox/inbox/delivery-attempt tables are on protected main; `integration_consumption` pending/processing/completed/quarantined persistence and expire-and-reclaim of a crashed processing claim exist only on this Active PR until merged.
+- `integration_outbox`, `integration_delivery_attempt`, `integration_inbox`, and `integration_consumption` reflect `src/integration.rs` domain semantics. Outbox/inbox/delivery-attempt tables are on protected main. Exclusive outbox delivery-lease columns (`lease_worker_ref`, `lease_ref`, `lease_fencing_token`, `lease_expires_at`, `delivery_lease_generation`) and database-clock expiry recovery exist only on Active PR #60 until merged. `integration_consumption` pending/processing/completed/quarantined persistence is already on protected main.
 
 This section is a maturity guard: a logical entity may be architecture-complete without being as-built database evidence.
 

migrations/0013_outbox_delivery_lease.sql

@@ -0,0 +1,157 @@
+ALTER TABLE integration_outbox
+    ADD COLUMN IF NOT EXISTS lease_worker_ref TEXT;
+
+ALTER TABLE integration_outbox
+    ADD COLUMN IF NOT EXISTS lease_ref TEXT;
+
+ALTER TABLE integration_outbox
+    ADD COLUMN IF NOT EXISTS lease_fencing_token BIGINT;
+
+ALTER TABLE integration_outbox
+    ADD COLUMN IF NOT EXISTS lease_expires_at_unix_ms BIGINT;
+
+ALTER TABLE integration_outbox
+    ADD COLUMN IF NOT EXISTS delivery_lease_generation BIGINT NOT NULL DEFAULT 0;
+
+DO $$
+BEGIN
+    IF NOT EXISTS (
+        SELECT 1
+        FROM pg_constraint AS constraint_row
+        JOIN pg_class AS relation_row
+          ON relation_row.oid = constraint_row.conrelid
+        JOIN pg_namespace AS namespace_row
+          ON namespace_row.oid = relation_row.relnamespace
+        WHERE constraint_row.conname = 'integration_outbox_lease_worker_ref_format_check'
+          AND relation_row.relname = 'integration_outbox'
+          AND namespace_row.nspname = current_schema()
+    ) THEN
+        ALTER TABLE integration_outbox
+            ADD CONSTRAINT integration_outbox_lease_worker_ref_format_check
+            CHECK (
+                lease_worker_ref IS NULL
+                OR (
+                    lease_worker_ref = btrim(lease_worker_ref)
+                    AND lease_worker_ref <> ''
+                    AND NOT (
+                        lease_worker_ref ~ '[[:digit:]]'
+                        AND lease_worker_ref ~ '^[[:digit:]+,.eE-]+$'
+                    )
+                )
+            );
+    END IF;
+
+    IF NOT EXISTS (
+        SELECT 1
+        FROM pg_constraint AS constraint_row
+        JOIN pg_class AS relation_row
+          ON relation_row.oid = constraint_row.conrelid
+        JOIN pg_namespace AS namespace_row
+          ON namespace_row.oid = relation_row.relnamespace
+        WHERE constraint_row.conname = 'integration_outbox_lease_ref_format_check'
+          AND relation_row.relname = 'integration_outbox'
+          AND namespace_row.nspname = current_schema()
+    ) THEN
+        ALTER TABLE integration_outbox
+            ADD CONSTRAINT integration_outbox_lease_ref_format_check
+            CHECK (
+                lease_ref IS NULL
+                OR (
+                    lease_ref = btrim(lease_ref)
+                    AND lease_ref <> ''
+                    AND NOT (
+                        lease_ref ~ '[[:digit:]]'
+                        AND lease_ref ~ '^[[:digit:]+,.eE-]+$'
+                    )
+                )
+            );
+    END IF;
+
+    IF NOT EXISTS (
+        SELECT 1
+        FROM pg_constraint AS constraint_row
+        JOIN pg_class AS relation_row
+          ON relation_row.oid = constraint_row.conrelid
+        JOIN pg_namespace AS namespace_row
+          ON namespace_row.oid = relation_row.relnamespace
+        WHERE constraint_row.conname = 'integration_outbox_lease_fencing_token_positive_check'
+          AND relation_row.relname = 'integration_outbox'
+          AND namespace_row.nspname = current_schema()
+    ) THEN
+        ALTER TABLE integration_outbox
+            ADD CONSTRAINT integration_outbox_lease_fencing_token_positive_check
+            CHECK (lease_fencing_token IS NULL OR lease_fencing_token > 0);
+    END IF;
+
+    IF NOT EXISTS (
+        SELECT 1
+        FROM pg_constraint AS constraint_row
+        JOIN pg_class AS relation_row
+          ON relation_row.oid = constraint_row.conrelid
+        JOIN pg_namespace AS namespace_row
+          ON namespace_row.oid = relation_row.relnamespace
+        WHERE constraint_row.conname = 'integration_outbox_lease_expiry_positive_check'
+          AND relation_row.relname = 'integration_outbox'
+          AND namespace_row.nspname = current_schema()
+    ) THEN
+        ALTER TABLE integration_outbox
+            ADD CONSTRAINT integration_outbox_lease_expiry_positive_check
+            CHECK (lease_expires_at_unix_ms IS NULL OR lease_expires_at_unix_ms > 0);
+    END IF;
+
+    IF NOT EXISTS (
+        SELECT 1
+        FROM pg_constraint AS constraint_row
+        JOIN pg_class AS relation_row
+          ON relation_row.oid = constraint_row.conrelid
+        JOIN pg_namespace AS namespace_row
+          ON namespace_row.oid = relation_row.relnamespace
+        WHERE constraint_row.conname = 'integration_outbox_delivery_lease_generation_nonnegative_check'
+          AND relation_row.relname = 'integration_outbox'
+          AND namespace_row.nspname = current_schema()
+    ) THEN
+        ALTER TABLE integration_outbox
+            ADD CONSTRAINT integration_outbox_delivery_lease_generation_nonnegative_check
+            CHECK (delivery_lease_generation >= 0);
+    END IF;
+
+    IF NOT EXISTS (
+        SELECT 1
+        FROM pg_constraint AS constraint_row
+        JOIN pg_class AS relation_row
+          ON relation_row.oid = constraint_row.conrelid
+        JOIN pg_namespace AS namespace_row
+          ON namespace_row.oid = relation_row.relnamespace
+        WHERE constraint_row.conname = 'integration_outbox_lease_presence_check'
+          AND relation_row.relname = 'integration_outbox'
+          AND namespace_row.nspname = current_schema()
+    ) THEN
+        ALTER TABLE integration_outbox
+            ADD CONSTRAINT integration_outbox_lease_presence_check
+            CHECK (
+                (lease_worker_ref IS NULL) = (lease_ref IS NULL)
+                AND (lease_worker_ref IS NULL) = (lease_fencing_token IS NULL)
+                AND (lease_worker_ref IS NULL) = (lease_expires_at_unix_ms IS NULL)
+            );
+    END IF;
+
+    IF NOT EXISTS (
+        SELECT 1
+        FROM pg_constraint AS constraint_row
+        JOIN pg_class AS relation_row
+          ON relation_row.oid = constraint_row.conrelid
+        JOIN pg_namespace AS namespace_row
+          ON namespace_row.oid = relation_row.relnamespace
+        WHERE constraint_row.conname = 'integration_outbox_fencing_generation_check'
+          AND relation_row.relname = 'integration_outbox'
+          AND namespace_row.nspname = current_schema()
+    ) THEN
+        ALTER TABLE integration_outbox
+            ADD CONSTRAINT integration_outbox_fencing_generation_check
+            CHECK (
+                lease_fencing_token IS NULL
+                OR lease_fencing_token = delivery_lease_generation
+            );
+    END IF;
+END
+$$;