The panel ratified two individually sound positions whose combination was impossible — the index that builds does not protect, and the index that protects does not build — then repaired the contradiction on the record.
A same-day fix for a PSP webhook that credited one $1,200 top-up twice: fact-owned idempotency in the same transaction as the ledger write, an advisory lock, prove-credit-before-200, a defensive partial unique index, and reconciliation. The proposed rollout kept intake live while constraints and new code were introduced. The panel's job was to find what could still fail while the fix appeared correct.
Event-ID locking could not stop payment_intent.succeeded and charge.succeeded from racing into two credits for one top-up. The authoritative identity became provider/account + fact type + PI/wallet.
UNIQUE(ledger_fact_id) was added alongside the PI/wallet constraint, and reconciliation of all in-flight top-ups moved before reopening rather than becoming a later sampling exercise.
Unique-index arbitration already single-flights the money write; a timed lock converts bounded contention into 5xx responses and more PSP retries. The room dropped the lock unanimously.
Historical duplicate credit rows prevent the unpredicated PI/wallet index from building. A fact-linked predicate can build, but old pods write NULL fact IDs and escape it. The moderator named the collision after both positions had been ratified; all three panelists confirmed it.
Corrected duplicate rows are marked superseded; old binaries omit the column and inherit canonical status, so once the index is valid their inserts fail closed. The marker changes classification, never financial history.
The final gate set checks net economic mismatch, at-most-one canonical credit per PI/wallet, and complete compensating-fact coverage. A count can look clean while the wallet is still wrong.
Old and new credit writers are never eligible together; canonical uniqueness is installed and proven before intake reopens.
GO under the staged-then-quiesced construction only. The service binary is replaceable; the new financial invariants and compensating history are not — after cutover, the migration is forward-only.
Condition: Quiesced cutover gates: every writer class proven disabled, a finance-signed compensation set, both unique indexes valid, and zero-unexplained-mismatch reconciliation before intake reopens.
GPT-5.6 Sol: 'Ship today' is not a safety requirement — accept a visible pending-top-up window rather than weaken a gate. Refuses to estimate the intake-closure window without a production dry run.
Grok 4.5: NO-GO if finance cannot sign the compensation set the same day or any writer class cannot be proven disabled.