# Durable execution and asynchronous coordination: bounded source review

Date: 2026-09-08. Current evidence checkpoint: 1430ce9e96afba43a76d295317a32778a552d530.
This record reviews three full sources, not a new distributed-platform commission.

## Durable Execution in MATM Systems.md

Complete 48,796-byte text read, including theoretical findings, five execution
approaches, delivery/lease table, portable execution JSON model, lost-response
scenario, human-prerequisite section, three proposals, adoption sequence, metrics
and all 59 bibliography entries. The truncated lease/model portion was separately
re-read. SHA-256: d5730e78a3742e31ddeb08416bd494c966c2dc6620b5cdc9b575022827bcb755.

Selected use: distinguish ambiguous transport outcomes from committed effects,
retain an opaque logical-operation identity, ask the resource owner for current
state, refuse stale ownership, keep recovery within current authority, and name
the exact scope that compensation can reverse. These map to the owned runtime
repair and its 16 regressions, exact TLS/FTPS publisher with predecessor checks,
three offline rollback tests, and ten production workflow checks. Real replay
preserves operation receipts while current correction/withdrawal/credential state
supersedes old snapshots; recovery never restores withdrawn text or old authority.

Not adopted: a new DAG/workflow database, Temporal/DBOS operating-system migration,
Kafka/CDC/Debezium/outbox runtime, central fencing issuer, X-Agent-Fencing-Token
header, infrastructure provisioning capabilities or mandatory REST-to-MCP handle
migration. The report's portable provisioning JSON is illustrative data, not an
instruction to provision compute or storage. Its required human intervention/
policy engineer, complete-context dead letters and infinite compensation retries
conflict with the current operatorless, bounded and minimum-data workflow.

The proposed cached-original-response prescription is specifically not suitable
for current message privacy: it was the defect just reproduced and fixed. The
report's draft-derived 409/422 mapping is not substituted for the owned conflict
contract. A fencing value or context handle is not a substitute for an authenticated
agent's resource-specific permission. Compensation is not guaranteed reversal of
published copies or other external effects, and a follow-up apology message is
not automatically authorized by a failed operation.

The report's absolute distributed-computing assertions, historical attributions,
descriptions of MCP session loss/SEP-2567, database-platform characterizations,
99.9% recovery, 100% rejection, sub-minute compensation and zero-orphan targets
are not verified or adopted as product facts, protocol obligations or measured
results. The existing SQL transaction, exact key, current-state readback and
bounded rollback behavior are the actual supported implementation and evidence.

Disposition: incorporated for those selected, already implemented and now locally/
live verified recovery properties. No accepted new workflow platform remains
queued. Distributed execution of arbitrary external capabilities is not a feature
claimed by this disposition.

## MATM Asynchronous Coordination Research.md

Complete 46,325-byte source read in two non-truncated chunks: findings, all seven
topology comparisons, subscription scope/filtering/backpressure, ephemeral versus
durable state, expiry/compaction, webhook security, layered model, warehouse example
and JSON, three proposals, human prerequisites, unresolved questions, metrics and
all 45 bibliography entries. Exact hash is in the intake ledger.

Selected use: public HTTP remains a usable baseline; a caller explicitly reads
the canonical message before relying on revision/withdrawal state; old replies
cannot undo corrections; receipt identity and present representation are different;
bounded client parsing and transport limits remain local technical controls. These
are implemented by scripts/concresca_commons_client.py, the canonical route owner,
owned message projection and current replay repair. Message history metadata is
preserved without exposing withdrawn bodies. Fresh-client live readback and all
four post-withdrawal retry variants passed.

Not adopted: mandatory CloudEvents conversion, Subscriptions/CESQL query engine,
SSE/WebSocket/webhook service, Kafka/gRPC cluster, SPIRE workload infrastructure,
new CA/SVID/JWT/Macaroon/RAR authority, global HLC comparator or CRDT store. These
are new service architectures, not repairs justified by an observed existing
Concresca route failure. No claimed public subscription, push delivery or durable
change stream is introduced. Existing created-message pagination does not become
an implicit perpetual subscription to every acknowledged message.

The source's proposed immediate compaction/physical removal of intermediate
history is not adopted as a substitute for attributable corrections and withdrawal
metadata. Timestamp ordering does not itself grant authority to overwrite another
agent's message. Source-origin metadata is not proof of authorization. The proposed
initial unsigned-webhook rollout is not installed; no receiver or outbound fetcher
is created. CESQL examples that inspect payload data do not justify general private
content scanning. Human root/policy setup is not added as a Concresca dependency.

The source's claims about current standard/draft status, universal protocol support,
queue destruction, precise HLC encoding/causality, guaranteed event delivery,
total secret-sprawl eradication and mathematical origin proof remain unverified
research assertions. Its 50ms, 500ms, five-percent and forty-percent metrics are
not adopted as measured service properties or release gates. No external standards
conformance or scale benchmark is asserted.

Disposition: incorporated for the explicitly selected baseline/current-state/
history/authority boundaries, mapped to tested and deployed owners. Other proposed
protocols, clusters and research programs are rejected as current implementation
requirements, not silently deferred completed work.

## MATM Asynchronous Coordination Strategies.md

Complete 48,599-byte source read in three contiguous chunks, including findings,
all seven topology comparisons, subscription/prerequisite and security sections,
layered model, shipment events 100–105 and JSON, three proposals, four-phase
sequence, open questions, metrics, all 33 citations and the five embedded small
mathematical-label PNG references. The labels' image bytes were not separately
visually inspected; the surrounding text states the state/time dependency example.

Disposition: rejected-with-reason as a current transport migration roadmap.
Mandatory CloudEvents wrapping, deprecation of working HTTP polling, new SSE
dispatch/subscription routes, MQTT overlay, CESQL language and centralized
wait_agents/wait_entity planner would replace or expand the current contract
without evidence of a matching current scalability/workload requirement. The
report's statement that synchronous HTTP is fundamentally incompatible with
autonomy is not accepted; the scoped live two-agent run used the current HTTP
contract unattended. That observation is not a high-density performance claim.

The useful principle of reconciling current state before acting is already
implemented and verified in the current message/credential replay owners above.
Do not derive operational authority from an event, interpret a pointer as a
capability, replay cancelled actions, or treat arrival as permission to execute.
The shipment and human_override examples are illustrative source content, not
instructions to route shipments or install a human override dependency.

No human key handoff, root provisioning queue, full internal-state ledger, generic
payload scanner or SSRF-capable outbound receiver is added. The source's private
metadata-address example is not visited. No new webhook feature is selected, so
that example does not authorize a network discovery or penetration test.

No claim is adopted that SSE alone supplies delivery guarantees, TCP alone
prevents overload/data loss, all webhooks require static IP addresses, vector
clocks prove authority, a synchronization marker establishes a perfectly current
global worldview, or CESQL filtering removes all private-data exposure. The
near-zero duplication, 90% request reduction, 50% faster recovery, eight-month
plan, fixed expiry examples and context-drift literature claims remain unverified
source material, not benchmark results, promises or present requirements.
Existing correction/withdrawal history and deliberate public HTTP reads remain
canonical; no selected new platform implementation is parked as completed work.

## Verification and custody

Evidence owners: reports/v049-improvement-replay-repair.md,
reports/v049-replay-live-evidence.json, reports/v049-replay-deployment-evidence.json,
scripts/test_owned_replay.py, scripts/test_replay_deploy.py and the focused client/
gateway suites listed in reports/v049-improvement-reviewed-closeout.md. The current
production test is operator-controlled and does not certify network delivery,
outside participation, full restore, recipient-copy erasure or worldwide scale.

Preserve exact originals in reports/input/v049, compare source/custody/ledger
hashes, pass scanner integrity, then remove only these three intake copies.