@adcp/sdk 14.0.0-rc.38 → 14.0.0-rc.39

package/dist/lib/reporting/ledger/postgres.js

@@ -19,6 +19,8 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var postgres_exports = {};
 __export(postgres_exports, {
   PostgresReportingLedgerStore: () => PostgresReportingLedgerStore,
+  REPORTING_LEDGER_FINALITY_FENCE_CONSTRAINT: () => REPORTING_LEDGER_FINALITY_FENCE_CONSTRAINT,
+  REPORTING_LEDGER_FINALITY_WRITER_FENCE_MIGRATION: () => REPORTING_LEDGER_FINALITY_WRITER_FENCE_MIGRATION,
   REPORTING_LEDGER_MIGRATION: () => REPORTING_LEDGER_MIGRATION,
   ReportingLedgerContinuityError: () => ReportingLedgerContinuityError,
   ReportingLedgerLeaseLostError: () => ReportingLedgerLeaseLostError,
@@ -35,6 +37,8 @@ var import_health = require('./health.js');
 var import_instant = require('./instant.js');
 var import_types = require('./types.js');
 var import_types2 = require('./types.js');
+var import_handler = require('./handler.js');
+var import_producer = require('./producer.js');
 var import_consumer_status_identity = require('./consumer-status-identity.js');
 const REPORTING_LEDGER_MIGRATION = `
 CREATE TABLE IF NOT EXISTS adcp_reporting_configurations (
@@ -182,6 +186,12 @@ CREATE INDEX IF NOT EXISTS adcp_reporting_consumer_statuses_scope
   ON adcp_reporting_consumer_statuses (account_id, consumer_id, created_at, consumer_status_id);
 CREATE UNIQUE INDEX IF NOT EXISTS adcp_reporting_consumer_statuses_current
   ON adcp_reporting_consumer_statuses (account_id, consumer_id, chain_key) WHERE is_current;
+-- The managed state digest is read inside the apply transaction, under the
+-- account lock. Filtering this table by obligation alone matched no index, so
+-- every apply scanned every consumer status in the deployment while holding
+-- that lock and pushed concurrent Core writes past their lock timeout.
+CREATE INDEX IF NOT EXISTS adcp_reporting_consumer_statuses_obligation
+  ON adcp_reporting_consumer_statuses (obligation_id, created_at, consumer_status_id);
 
 CREATE TABLE IF NOT EXISTS adcp_reporting_consumer_status_batches (
   account_id TEXT NOT NULL,
@@ -206,6 +216,29 @@ CREATE TABLE IF NOT EXISTS adcp_reporting_issues (
 CREATE INDEX IF NOT EXISTS adcp_reporting_issues_obligation
   ON adcp_reporting_issues (obligation_id, observed_at, issue_id);
 
+-- Per-obligation reconciliation watermark. A reconcile that changes nothing
+-- still has to record that it looked, or a change with no health effect stays
+-- a candidate forever and starves newer work behind it. Core, not managed:
+-- the lifecycle sweep is a Core concern and must not depend on the add-on.
+CREATE TABLE IF NOT EXISTS adcp_reporting_lifecycle_state (
+  obligation_id TEXT PRIMARY KEY REFERENCES adcp_reporting_obligations(obligation_id),
+  processed_state_version TEXT,
+  processed_roster_version TEXT,
+  processed_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp()
+);
+CREATE INDEX IF NOT EXISTS adcp_reporting_lifecycle_state_processed
+  ON adcp_reporting_lifecycle_state (processed_at, obligation_id);
+ALTER TABLE adcp_reporting_lifecycle_state
+  ADD COLUMN IF NOT EXISTS current_roster_version TEXT;
+ALTER TABLE adcp_reporting_lifecycle_state
+  ADD COLUMN IF NOT EXISTS failure_count INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE adcp_reporting_lifecycle_state
+  ADD COLUMN IF NOT EXISTS next_attempt_at TIMESTAMPTZ;
+ALTER TABLE adcp_reporting_lifecycle_state
+  ADD COLUMN IF NOT EXISTS roster_refreshed_at TIMESTAMPTZ;
+CREATE INDEX IF NOT EXISTS adcp_reporting_lifecycle_state_roster_refreshed
+  ON adcp_reporting_lifecycle_state (roster_refreshed_at, obligation_id);
+
 CREATE TABLE IF NOT EXISTS adcp_reporting_transitions (
   transition_id TEXT PRIMARY KEY,
   transition_sequence BIGSERIAL NOT NULL UNIQUE,
@@ -245,7 +278,23 @@ CREATE TABLE IF NOT EXISTS adcp_reporting_checkpoints (
 CREATE INDEX IF NOT EXISTS adcp_reporting_checkpoints_expiry
   ON adcp_reporting_checkpoints (expires_at);
 `.trim();
+const REPORTING_LEDGER_FINALITY_FENCE_CONSTRAINT = "adcp_reporting_transitions_finality_recorded";
+const REPORTING_LEDGER_FINALITY_WRITER_FENCE_MIGRATION = `
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+     WHERE conrelid = 'adcp_reporting_transitions'::regclass
+       AND conname = '${REPORTING_LEDGER_FINALITY_FENCE_CONSTRAINT}'
+  ) THEN
+    ALTER TABLE adcp_reporting_transitions
+      ADD CONSTRAINT ${REPORTING_LEDGER_FINALITY_FENCE_CONSTRAINT}
+      CHECK (data ? 'finality') NOT VALID;
+  END IF;
+END $$;
+`.trim();
 const MAX_SNAPSHOT_ITEMS = 1e4;
+const MAX_LIFECYCLE_RECEIPT_LEAVES = 1e5;
 const MAX_SNAPSHOT_BYTES = 8 * 1024 * 1024;
 const MAX_ACTIVE_SNAPSHOTS_PER_ACCOUNT = 32;
 const MAX_ACTIVE_SNAPSHOT_BYTES_PER_ACCOUNT = 128 * 1024 * 1024;
@@ -300,6 +349,9 @@ async function sweepExpiredReportingLedgerState(pool, limit = 1e3) {
 class PostgresReportingLedgerStore {
   constructor(pool, options = {}) {
     this.pool = pool;
+    this.managedDelivery = options.managedDelivery === true;
+    this.obligatedConsumers = options.obligatedConsumers;
+    this[import_types.REPORTING_LEDGER_AUTHORITY] = { substrate: pool, managedDelivery: this.managedDelivery };
     const development = process.env.NODE_ENV === "test" || process.env.NODE_ENV === "development";
     if (!development && !options.acknowledgeIsolatedDatabase) {
       throw new Error(
@@ -307,6 +359,8 @@ class PostgresReportingLedgerStore {
       );
     }
     this.consumerMismatchEscalation = (0, import_health.assertReportingConsumerMismatchEscalation)(options.consumerMismatchEscalation);
+    this.notificationActivityPort = options.notificationActivityPort;
+    this.transactionalNotificationActivity = options.notificationActivityPort !== void 0;
   }
   pool;
   /**
@@ -317,6 +371,11 @@ class PostgresReportingLedgerStore {
    * contradict the summary.
    */
   consumerMismatchEscalation;
+  [import_types.REPORTING_LEDGER_AUTHORITY];
+  managedDelivery;
+  obligatedConsumers;
+  transactionalNotificationActivity;
+  notificationActivityPort;
   async putConfiguration(configuration) {
     return this.transaction(
       async (client) => {
@@ -417,14 +476,26 @@ class PostgresReportingLedgerStore {
     positiveInteger(input.limit, "limit");
     if (input.limit > 1e3) throw new RangeError("limit must not exceed 1000");
     if (!Number.isFinite(Date.parse(input.ledgerAsOf))) throw new TypeError("ledgerAsOf must be an RFC 3339 instant");
+    const managedDueArm = await this.managedDueTablesReady() ? MANAGED_DUE_ARM : "";
     const result = await this.query(
       `SELECT obligation.data FROM adcp_reporting_obligations obligation
        LEFT JOIN LATERAL (
-         SELECT transition.data->>'health' AS health
+         SELECT transition.data->>'health' AS health, transition.occurred_at
            FROM adcp_reporting_transitions transition
           WHERE transition.obligation_id = obligation.obligation_id
           ORDER BY transition.transition_sequence DESC LIMIT 1
        ) latest ON TRUE
+       LEFT JOIN adcp_reporting_lifecycle_state state
+              ON state.obligation_id = obligation.obligation_id
+       CROSS JOIN LATERAL (
+         -- A reconcile that changed no health still has to count as work done,
+         -- or a managed change with no health effect keeps the obligation due
+         -- forever and, at small page sizes, starves everything behind it.
+         SELECT GREATEST(
+                  COALESCE(state.processed_at, obligation.created_at),
+                  COALESCE(latest.occurred_at, obligation.created_at)
+                ) AS since
+       ) watermark
        WHERE ($1::text IS NULL OR obligation.account_id = $1)
          AND ((COALESCE(latest.health, 'waiting') = 'waiting'
                AND (obligation.data->>'expectedAt')::timestamptz <= $2)
@@ -435,8 +506,14 @@ class PostgresReportingLedgerStore {
                AND EXISTS (
                  SELECT 1 FROM adcp_reporting_revisions revision
                   WHERE revision.obligation_id = obligation.obligation_id
-               )))
-       ORDER BY LEAST(
+               ))
+${managedDueArm}       )
+         -- A tenant that keeps failing must not monopolise every sweep. Its
+         -- backoff cursor holds it out of selection until it is due again,
+         -- while processed_at ordering still favours whoever has waited
+         -- longest among the eligible.
+         AND (state.next_attempt_at IS NULL OR state.next_attempt_at <= $2)
+       ORDER BY watermark.since, LEAST(
          (obligation.data->>'expectedAt')::timestamptz,
          (obligation.data->>'recoveryDeadlineAt')::timestamptz
        ), obligation.obligation_id
@@ -583,7 +660,8 @@ class PostgresReportingLedgerStore {
         obligationId: revision.reporting_obligation_id,
         owner: lease.owner,
         generation: lease.generation
-      }
+      },
+      revisionLegacyCanonicalDigestReplay
     );
   }
   async getRevision(id, accountId) {
@@ -657,7 +735,8 @@ class PostgresReportingLedgerStore {
         obligationId: adjustment.reporting_obligation_id,
         owner: lease.owner,
         generation: lease.generation
-      }
+      },
+      adjustmentLegacyCanonicalDigestReplay
     );
   }
   async listAdjustments(obligationId) {
@@ -1048,27 +1127,59 @@ class PostgresReportingLedgerStore {
     );
     return result.rows.map((row) => clone(row.data));
   }
+  /**
+   * Resolves — and for pre-SDK-14 rows persists — the observed finality baseline
+   * of the obligation's latest transition, so the lifecycle decision and this
+   * store's compare-and-set read one committed value.
+   */
+  async resolveTransitionFinalityBaseline(obligationId) {
+    const lock = await this.accountLockForObligation(obligationId);
+    return this.transaction((client) => resolveStoredFinalityBaseline(client, obligationId), {
+      preBeginAdvisoryLock: lock
+    });
+  }
   async appendTransition(transition) {
     const lock = await this.accountLockForObligation(transition.reporting_obligation_id);
+    return assertFinalityWriterFence(() => this.appendTransitionWithinLock(transition, lock));
+  }
+  async appendTransitionWithinLock(transition, lock) {
     return this.transaction(
       async (client) => {
+        if (this.notificationActivityPort) {
+          await assertNoLegacyPendingTransitions(client, transition.reporting_obligation_id);
+        }
+        const previousFinality = await resolveStoredFinalityBaseline(client, transition.reporting_obligation_id);
+        const latest = await client.query(
+          `SELECT data->>'health' AS health FROM adcp_reporting_transitions
+            WHERE obligation_id = $1 ORDER BY transition_sequence DESC LIMIT 1`,
+          [transition.reporting_obligation_id]
+        );
+        if ((latest.rows[0]?.health ?? "waiting") !== transition.previousHealth || transition.previousFinality !== void 0 && previousFinality !== transition.previousFinality) {
+          return { inserted: false };
+        }
+        const storedTransition = this.notificationActivityPort ? { ...transition, notifiedAt: transition.occurredAt } : transition;
         const result = await client.query(
           `INSERT INTO adcp_reporting_transitions (transition_id, obligation_id, data, occurred_at)
-       SELECT $1, $2, $3::jsonb, $4
-        WHERE COALESCE((
-          SELECT previous.data->>'health' FROM adcp_reporting_transitions previous
-           WHERE previous.obligation_id = $2
-           ORDER BY previous.transition_sequence DESC LIMIT 1
-        ), 'waiting') = $5
-       ON CONFLICT DO NOTHING RETURNING transition_id`,
+           VALUES ($1, $2, $3::jsonb, $4)
+           ON CONFLICT DO NOTHING RETURNING transition_id`,
           [
             transition.transitionId,
             transition.reporting_obligation_id,
-            JSON.stringify(transition),
-            transition.occurredAt,
-            transition.previousHealth
+            JSON.stringify(storedTransition),
+            transition.occurredAt
           ]
         );
+        if (result.rowCount === 1 && this.notificationActivityPort) {
+          const obligation = await client.query(
+            "SELECT data FROM adcp_reporting_obligations WHERE obligation_id = $1",
+            [transition.reporting_obligation_id]
+          );
+          if (!obligation.rows[0]) throw new Error("Reporting obligation is unavailable");
+          await this.notificationActivityPort.recordTransition(
+            { transition, obligation: obligation.rows[0].data },
+            client
+          );
+        }
         return { inserted: result.rowCount === 1 };
       },
       { preBeginAdvisoryLock: lock }
@@ -1076,12 +1187,19 @@ class PostgresReportingLedgerStore {
   }
   async applyLifecycleProjection(input) {
     const lock = await this.accountLockForObligation(input.reporting_obligation_id);
+    return assertFinalityWriterFence(() => this.applyLifecycleProjectionWithinLock(input, lock));
+  }
+  async applyLifecycleProjectionWithinLock(input, lock) {
     return this.transaction(
       async (client) => {
         const obligations = await client.query(
           `SELECT data FROM adcp_reporting_obligations WHERE obligation_id = $1 FOR UPDATE`,
           [input.reporting_obligation_id]
         );
+        if (this.notificationActivityPort) {
+          await assertNoLegacyPendingTransitions(client, input.reporting_obligation_id);
+        }
+        const previousFinality = await resolveStoredFinalityBaseline(client, input.reporting_obligation_id);
         const revisions = await client.query(
           `SELECT revision_id FROM adcp_reporting_revisions
             WHERE obligation_id = $1 ORDER BY revision_number, revision_id`,
@@ -1095,11 +1213,26 @@ class PostgresReportingLedgerStore {
         const revisionIds = revisions.rows.map((value) => value.revision_id);
         const previousHealth = latest.rows[0]?.health ?? "waiting";
         const obligation = obligations.rows[0]?.data;
-        if (!obligation || obligation.state !== input.expectedObligationState || obligation.attemptCount !== input.expectedAttemptCount || (0, import_source.canonicalJsonV1)(revisionIds) !== (0, import_source.canonicalJsonV1)(input.expectedRevisionIds) || previousHealth !== input.expectedPreviousHealth) {
+        if (!obligation || obligation.state !== input.expectedObligationState || obligation.attemptCount !== input.expectedAttemptCount || (0, import_source.canonicalJsonV1)(revisionIds) !== (0, import_source.canonicalJsonV1)(input.expectedRevisionIds) || previousHealth !== input.expectedPreviousHealth || input.expectedPreviousFinality !== void 0 && previousFinality !== input.expectedPreviousFinality) {
           return { applied: false, transitionInserted: false };
         }
+        if (input.expectedManagedStateVersion !== void 0 && await this.readManagedStateVersion(client, input.reporting_obligation_id) !== input.expectedManagedStateVersion) {
+          return { applied: false, transitionInserted: false };
+        }
+        if (input.expectedObligatedConsumerRosterVersion !== void 0) {
+          const state = await client.query(
+            `SELECT current_roster_version FROM adcp_reporting_lifecycle_state
+              WHERE obligation_id = $1 FOR UPDATE`,
+            [input.reporting_obligation_id]
+          );
+          const observed = state.rows[0]?.current_roster_version;
+          if (observed !== void 0 && observed !== input.expectedObligatedConsumerRosterVersion) {
+            return { applied: false, transitionInserted: false };
+          }
+        }
         let transitionInserted = false;
         if (input.transition) {
+          const storedTransition = this.notificationActivityPort ? { ...input.transition, notifiedAt: input.ledgerAsOf } : input.transition;
           const inserted = await client.query(
             `INSERT INTO adcp_reporting_transitions (transition_id, obligation_id, data, occurred_at)
              VALUES ($1, $2, $3::jsonb, $4)
@@ -1107,12 +1240,60 @@ class PostgresReportingLedgerStore {
             [
               input.transition.transitionId,
               input.reporting_obligation_id,
-              JSON.stringify(input.transition),
+              JSON.stringify(storedTransition),
               input.transition.occurredAt
             ]
           );
           if (inserted.rowCount !== 1) return { applied: false, transitionInserted: false };
           transitionInserted = true;
+          if (this.notificationActivityPort) {
+            await this.notificationActivityPort.recordTransition({ transition: input.transition, obligation }, client);
+          }
+        }
+        {
+          await client.query(
+            `INSERT INTO adcp_reporting_lifecycle_state
+               (obligation_id, processed_state_version, processed_roster_version,
+                current_roster_version, processed_at)
+             VALUES ($1, $2, $3, $3, LEAST($4::timestamptz, clock_timestamp()))
+             ON CONFLICT (obligation_id) DO UPDATE SET
+               processed_state_version = EXCLUDED.processed_state_version,
+               processed_roster_version = EXCLUDED.processed_roster_version,
+               -- Reconciling also observes the roster, so the current version
+               -- moves with the processed one. A later external change
+               -- publishes a different current version and re-arms; without
+               -- this the two never matched and the obligation stayed due.
+               -- Never over a version this reconcile did not observe: if the
+               -- row was created or advanced after the check above, that
+               -- newer observation is what has to survive, or its re-arm is
+               -- silently dropped.
+               current_roster_version = CASE
+                 WHEN $5::text IS NOT NULL
+                  AND adcp_reporting_lifecycle_state.current_roster_version IS DISTINCT FROM $5::text
+                 THEN adcp_reporting_lifecycle_state.current_roster_version
+                 ELSE EXCLUDED.processed_roster_version END,
+               processed_at = EXCLUDED.processed_at,
+               failure_count = 0,
+               next_attempt_at = NULL`,
+            [
+              input.reporting_obligation_id,
+              input.processedManagedStateVersion ?? null,
+              // Empty string, not null: null means "never reconciled", which
+              // is a due condition. A deployment with no roster source would
+              // otherwise stay due forever.
+              input.processedObligatedConsumerRosterVersion ?? "",
+              // The cutoff the projection actually read at, never the commit
+              // instant. Watermarking at commit time swallowed everything
+              // that landed between the two: excluded from the projection,
+              // and then behind the watermark forever, so it never became
+              // due again. It is clamped to this database's clock in SQL
+              // below, because a cutoff ahead of the ledger buries
+              // database-timestamped work the same way for the opposite
+              // reason.
+              input.ledgerAsOf,
+              input.expectedObligatedConsumerRosterVersion ?? null
+            ]
+          );
         }
         const projectedIds = input.projectedIssues.map((issue) => issue.issueId);
         for (const issue of input.projectedIssues) {
@@ -1135,7 +1316,17 @@ class PostgresReportingLedgerStore {
                   data = data || jsonb_build_object('resolvedAt', $2::text),
                   changed_at = clock_timestamp()
             WHERE obligation_id = $1 AND resolved_at IS NULL
-              AND data->>'code' IN ('REPORT_OVERDUE', 'REPORTING_COVERAGE_INCOMPLETE')
+              -- Every code this projection can emit, not only the Core two.
+              -- A managed DELIVERY_FAILED persisted by an earlier reconcile
+              -- was never cleared, so after a successful redelivery the
+              -- status kept publishing a stale delivery failure for as long
+              -- as Core stayed degraded for some unrelated reason.
+              AND data->>'code' IN (
+                'REPORT_OVERDUE', 'REPORTING_COVERAGE_INCOMPLETE',
+                'DELIVERY_FAILED', 'RESOURCE_EXPIRED',
+                'RECEIPT_REQUIRED', 'RECEIPT_REJECTED',
+                'ADJUSTMENT_RECEIPT_REQUIRED', 'ADJUSTMENT_RECEIPT_REJECTED'
+              )
               AND NOT (issue_id = ANY($3::text[]))`,
           [input.reporting_obligation_id, input.ledgerAsOf, projectedIds]
         );
@@ -1152,6 +1343,7 @@ class PostgresReportingLedgerStore {
         await client.query(
           `UPDATE adcp_reporting_transitions
           SET data = data || jsonb_build_object('notifiedAt', $2::text)
+              || CASE WHEN data ? 'finality' THEN '{}'::jsonb ELSE jsonb_build_object('finality', 'none') END
         WHERE transition_id = $1 AND NOT (data ? 'notifiedAt')`,
           [transitionId, notifiedAt]
         );
@@ -1209,11 +1401,31 @@ class PostgresReportingLedgerStore {
         }
         const activeSnapshotBytes = Number(active.rows[0]?.bytes ?? 0);
         const changesAfter = query.changes_after ? await this.resolveChangesCheckpoint(client, query, query.changes_after) : void 0;
+        const managedInstalled = this.managedDelivery && await this.managedTablesInstalled(client);
         const configurations = await this.listSnapshotConfigurations(client, query, ledgerAsOf);
         if (configurations.length > MAX_SNAPSHOT_ITEMS) {
           throw new Error("Reporting ledger snapshot exceeds the configuration limit");
         }
         let obligations = await this.listSnapshotObligations(client, query, ledgerAsOf, changesAfter);
+        if (managedInstalled && changesAfter) {
+          const managedChangedIds = await this.listManagedChangedObligationIds(client, query, ledgerAsOf, changesAfter);
+          if (managedChangedIds.size) {
+            const fullScope = await this.listSnapshotObligations(
+              client,
+              { ...query, changes_after: void 0, health: void 0 },
+              ledgerAsOf
+            );
+            const byId = new Map(obligations.map((value) => [value.reporting_obligation_id, value]));
+            for (const obligation of fullScope) {
+              if (managedChangedIds.has(obligation.reporting_obligation_id)) {
+                byId.set(obligation.reporting_obligation_id, obligation);
+              }
+            }
+            obligations = [...byId.values()].sort(
+              (left, right) => left.period.start.localeCompare(right.period.start) || left.reporting_obligation_id.localeCompare(right.reporting_obligation_id)
+            );
+          }
+        }
         if (obligations.length > MAX_SNAPSHOT_ITEMS) {
           throw new Error("Reporting ledger snapshot exceeds the item limit");
         }
@@ -1265,6 +1477,30 @@ class PostgresReportingLedgerStore {
           throw new Error("Reporting ledger snapshot exceeds the item limit");
         }
         let issues = await this.listSnapshotIssues(client, obligationIds, MAX_SNAPSHOT_ITEMS + 1);
+        const managedBindings = managedInstalled ? await this.listSnapshotManagedBindings(
+          client,
+          configurations.map((value) => value.configurationId)
+        ) : [];
+        let materializations = managedInstalled ? await this.listSnapshotMaterializations(client, obligationIds, ledgerAsOf, changesAfter) : [];
+        let receipts = managedInstalled && query.consumer_id ? await this.listSnapshotReceipts(client, query, obligationIds, ledgerAsOf, changesAfter, "revision") : [];
+        let adjustmentReceipts = managedInstalled && query.consumer_id ? await this.listSnapshotReceipts(client, query, obligationIds, ledgerAsOf, changesAfter, "adjustment") : [];
+        const tombstonedAcceptedSubjects = managedInstalled ? (await this.listTombstonedAcceptedSubjects(client, query, obligationIds, false, ledgerAsOf)).subjects : [];
+        const tombstonedDeliveredRevisionIds = managedInstalled ? (await client.query(
+          `SELECT revision_id FROM adcp_reporting_materialization_tombstones
+                  WHERE obligation_id = ANY($1::text[]) AND reached_success
+                    AND COALESCE(reached_success_at, pruned_at) <= $3::timestamptz LIMIT $2`,
+          [obligationIds, MAX_SNAPSHOT_ITEMS + 1, ledgerAsOf]
+        )).rows.map((row) => row.revision_id) : [];
+        const materializationProjection = managedInstalled ? await this.listSnapshotMaterializationProjection(client, obligationIds, ledgerAsOf) : [];
+        const materializationHistoryProjection = managedInstalled && changesAfter ? await this.listSnapshotMaterializations(client, obligationIds, ledgerAsOf) : materializations;
+        const receiptProjection = managedInstalled && query.consumer_id && changesAfter ? await this.listSnapshotReceipts(client, query, obligationIds, ledgerAsOf, void 0, "revision") : receipts;
+        const adjustmentReceiptProjection = managedInstalled && query.consumer_id && changesAfter ? await this.listSnapshotReceipts(client, query, obligationIds, ledgerAsOf, void 0, "adjustment") : adjustmentReceipts;
+        if (materializationProjection.length > MAX_SNAPSHOT_ITEMS || materializationHistoryProjection.length > MAX_SNAPSHOT_ITEMS || receiptProjection.length > MAX_SNAPSHOT_ITEMS || adjustmentReceiptProjection.length > MAX_SNAPSHOT_ITEMS) {
+          throw new Error("Reporting ledger snapshot exceeds the managed projection limit");
+        }
+        if (obligations.length + revisions.length + adjustments.length + consumerStatuses.length + materializations.length + receipts.length + adjustmentReceipts.length > MAX_SNAPSHOT_ITEMS) {
+          throw new Error("Reporting ledger snapshot exceeds the item limit");
+        }
         if (issues.length > MAX_SNAPSHOT_ITEMS) throw new Error("Reporting ledger snapshot exceeds the issue limit");
         if (query.view === "periods" && query.health) {
           const scopedObligations = obligations;
@@ -1289,7 +1525,34 @@ class PostgresReportingLedgerStore {
                 ledgerAsOf,
                 this.consumerMismatchEscalation
               );
-              return query.health.includes(mismatch?.health ?? sellerHealth);
+              const baseProjection = (0, import_health.projectReportingObligationHealthV1)(
+                value,
+                obligationRevisions,
+                ledgerAsOf,
+                (0, import_coverage.reportingLedgerScopeClosed)(query, ledgerAsOf, ledgerCoverage.complete)
+              );
+              const managed = (0, import_handler.projectManagedDelivery)({
+                obligation: value,
+                binding: managedBindings.find((binding) => binding.configurationId === value.configurationId),
+                revisions: obligationRevisions,
+                adjustments: adjustments.filter(
+                  (item) => item.reporting_obligation_id === value.reporting_obligation_id
+                ),
+                materializations: materializationProjection.filter(
+                  (item) => item.reporting_obligation_id === value.reporting_obligation_id
+                ),
+                materializationHistory: materializationHistoryProjection.filter(
+                  (item) => item.reporting_obligation_id === value.reporting_obligation_id
+                ),
+                receipts: receiptProjection,
+                adjustmentReceipts: adjustmentReceiptProjection,
+                base: baseProjection,
+                ledgerAsOf,
+                tombstonedAcceptedSubjects,
+                tombstonedDeliveredRevisionIds
+              });
+              const health = mismatch ? (0, import_handler.moreSevereReportingHealthV1)(managed?.projection.health ?? sellerHealth, mismatch.health) : managed?.projection.health ?? sellerHealth;
+              return query.health.includes(health);
             }).map((value) => value.reporting_obligation_id)
           );
           const obligationsByConsumerStatusChain = new Map(
@@ -1305,6 +1568,13 @@ class PostgresReportingLedgerStore {
           obligations = obligations.filter((value) => accepted.has(value.reporting_obligation_id));
           revisions = revisions.filter((value) => accepted.has(value.reporting_obligation_id));
           adjustments = adjustments.filter((value) => accepted.has(value.reporting_obligation_id));
+          materializations = materializations.filter((value) => accepted.has(value.reporting_obligation_id));
+          const acceptedRevisionIds = new Set(revisions.map((value) => value.reporting_revision_id));
+          const acceptedAdjustmentIds = new Set(adjustments.map((value) => value.reporting_adjustment_id));
+          receipts = receipts.filter((value) => acceptedRevisionIds.has(value.reporting_revision_id));
+          adjustmentReceipts = adjustmentReceipts.filter(
+            (value) => acceptedAdjustmentIds.has(value.reporting_adjustment_id)
+          );
           consumerStatuses = consumerStatuses.filter((value) => {
             const key = (0, import_consumer_status_identity.reportingConsumerStatusChainKeyV1)(value);
             const matchingObligation = obligationsByConsumerStatusChain.get(key);
@@ -1329,6 +1599,18 @@ class PostgresReportingLedgerStore {
           obligations,
           revisions,
           adjustments,
+          ...managedInstalled ? {
+            tombstonedAcceptedSubjects,
+            tombstonedDeliveredRevisionIds,
+            managedBindings,
+            materializations,
+            materializationHistoryProjection,
+            materializationProjection,
+            receipts,
+            receiptProjection,
+            adjustmentReceipts,
+            adjustmentReceiptProjection
+          } : {},
           consumerStatuses,
           consumerStatusProjection,
           issues
@@ -1398,6 +1680,13 @@ class PostgresReportingLedgerStore {
     const consumerStatuses = selected.filter(
       (value) => value.kind === "consumer_status"
     ).map((value) => value.value);
+    const materializations = selected.filter(
+      (value) => value.kind === "materialization"
+    ).map((value) => value.value);
+    const receipts = selected.filter((value) => value.kind === "receipt").map((value) => value.value);
+    const adjustmentReceipts = selected.filter(
+      (value) => value.kind === "adjustment_receipt"
+    ).map((value) => value.value);
     const nextOffset = offset + selected.length;
     const hasMore = nextOffset < items.length;
     return {
@@ -1405,6 +1694,9 @@ class PostgresReportingLedgerStore {
       obligations,
       revisions,
       adjustments,
+      materializations,
+      receipts,
+      adjustmentReceipts,
       consumerStatuses,
       totalCount: items.length,
       offset,
@@ -1584,11 +1876,614 @@ class PostgresReportingLedgerStore {
     );
     return result.rows.map((row) => row.data);
   }
+  /**
+   * Managed Delivery projection inputs for one obligation, grouped per consumer.
+   *
+   * The lifecycle reconciler folds these through the same
+   * `projectManagedDelivery` the read path uses, so a persisted transition and
+   * its webhook report the health a read of the same obligation would return.
+   * Returns `null` when Managed Delivery is not installed or the obligation's
+   * configuration has no binding, which keeps a Core-only ledger unchanged.
+   */
+  async getManagedLifecycleProjection(input) {
+    if (!this.managedDelivery) return null;
+    const base = await this.transaction(
+      async (client) => {
+        if (!await this.managedTablesInstalled(client)) return null;
+        const obligation = await client.query(
+          "SELECT configuration_id FROM adcp_reporting_obligations WHERE obligation_id = $1",
+          [input.reporting_obligation_id]
+        );
+        const configurationId = obligation.rows[0]?.configuration_id;
+        if (!configurationId) return null;
+        const [binding] = await this.listSnapshotManagedBindings(client, [configurationId]);
+        if (!binding) return null;
+        const resolvedLedgerAsOf = (await client.query(
+          // RFC 3339 with microseconds. PostgreSQL's own ::text rendering
+          // uses a space separator and a two-digit offset, which the SDK's
+          // instant parser rejects, and round-tripping through a JS Date
+          // would truncate the microseconds this exists to preserve.
+          `SELECT ${rfc3339Microseconds("COALESCE($1::timestamptz, clock_timestamp())")} AS instant`,
+          [input.ledgerAsOf ?? null]
+        )).rows[0].instant;
+        const rows = await client.query(
+          `SELECT materialization.data,
+                  materialization.changed_at > $2::timestamptz AS settled_after_cutoff,
+                  CASE WHEN authz.revoked_at <= $2::timestamptz THEN authz.revoked_at END AS revoked_at
+             FROM adcp_reporting_materializations materialization
+             JOIN adcp_reporting_destination_authorizations authz
+               ON authz.account_id = materialization.account_id
+              AND authz.destination_ref = materialization.destination_ref
+              AND authz.generation = materialization.authorization_generation
+            WHERE materialization.obligation_id = $1
+              AND materialization.recorded_at <= $2::timestamptz
+            ORDER BY materialization.attempt, materialization.materialization_id
+            LIMIT $3`,
+          [input.reporting_obligation_id, resolvedLedgerAsOf, MAX_SNAPSHOT_ITEMS + 1]
+        );
+        if (rows.rows.length > MAX_SNAPSHOT_ITEMS) {
+          throw new Error("Reporting lifecycle projection exceeds the managed materialization limit");
+        }
+        const placed = rows.rows.map((row) => ({
+          atAsOf: row.settled_after_cutoff ? pendingAtCutoff(row.data) : clone(row.data),
+          revokedAt: row.revoked_at
+        }));
+        const materializationHistory = placed.map((value) => value.atAsOf);
+        const materializations = placed.map(
+          ({ atAsOf, revokedAt }) => revokedAt && (atAsOf.status === "available" || atAsOf.status === "delivered") ? {
+            ...atAsOf,
+            status: "failed",
+            failed_at: revokedAt.toISOString(),
+            failure_code: "AUTHORIZATION_REVOKED"
+          } : atAsOf
+        );
+        const receipts = await client.query(
+          `WITH subject AS (
+             -- Drive from this obligation's own subjects. Asking the global
+             -- receipt table "which of your rows belong to this obligation"
+             -- matched no index \u2014 they lead with account and consumer, and
+             -- this question supplies neither \u2014 so every due obligation
+             -- re-scanned the whole receipt history.
+             SELECT revision_id AS subject_id, 'revision' AS receipt_kind
+               FROM adcp_reporting_revisions WHERE obligation_id = $1
+             UNION ALL
+             SELECT adjustment_id, 'adjustment'
+               FROM adcp_reporting_adjustments WHERE obligation_id = $1
+           )
+           SELECT receipt.consumer_id, receipt.receipt_kind, receipt.data
+           FROM subject
+           JOIN adcp_reporting_receipts receipt
+             ON receipt.subject_id = subject.subject_id
+            AND receipt.receipt_kind = subject.receipt_kind
+          -- Ordered and cut off by the database clock, exactly as every other
+          -- receipt read path is, so a skewed host cannot make the lifecycle
+          -- projection see a different receipt set than get_reporting_status.
+          --
+          -- One leaf per chain, resolved AS OF the cutoff. The fold reads
+          -- exactly one thing from each chain, and walking the whole history
+          -- to find it pushed this read past its bound for a subject repaired
+          -- often enough. But is_current is today's answer: at a cutoff
+          -- before an acceptance superseded a rejection, the rejection was no
+          -- longer current and the acceptance was not yet in scope, so the
+          -- projection saw neither and persisted RECEIPT_REQUIRED over a
+          -- rejection the buyer had already filed. The leaf at the cutoff is
+          -- the receipt that nothing recorded by then supersedes. Wire
+          -- counters are computed on the read path, which still sees every
+          -- row.
+          WHERE receipt.recorded_at <= $2
+            AND NOT EXISTS (
+              SELECT 1 FROM adcp_reporting_receipts successor
+               WHERE successor.account_id = receipt.account_id
+                 AND successor.consumer_id = receipt.consumer_id
+                 AND successor.supersedes_receipt_id = receipt.reporting_receipt_id
+                 AND successor.recorded_at <= $2
+            )
+            -- A successor whose body has been pruned still superseded this
+            -- row. Counting only live successors let retention resurrect the
+            -- rejected predecessor of a pruned acceptance as the live leaf,
+            -- which overrode that acceptance's own tombstone and reopened a
+            -- settled subject the write path then refused to repair.
+            AND NOT EXISTS (
+              SELECT 1 FROM adcp_reporting_receipt_tombstones gone
+               WHERE gone.account_id = receipt.account_id
+                 AND gone.consumer_id = receipt.consumer_id
+                 AND gone.supersedes_receipt_id = receipt.reporting_receipt_id
+                 AND COALESCE(gone.subject_recorded_at, gone.pruned_at) <= $2
+            )
+          ORDER BY receipt.consumer_id, receipt.subject_id, receipt.recorded_at, receipt.reporting_receipt_id
+          LIMIT $3`,
+          [input.reporting_obligation_id, resolvedLedgerAsOf, MAX_LIFECYCLE_RECEIPT_LEAVES + 1]
+        );
+        let receiptEvidenceComplete = true;
+        let leaves = receipts.rows;
+        if (leaves.length > MAX_LIFECYCLE_RECEIPT_LEAVES) {
+          receiptEvidenceComplete = false;
+          const partial = leaves[MAX_LIFECYCLE_RECEIPT_LEAVES].consumer_id;
+          leaves = leaves.slice(0, MAX_LIFECYCLE_RECEIPT_LEAVES).filter((row) => row.consumer_id !== partial);
+        }
+        const byConsumer = /* @__PURE__ */ new Map();
+        for (const row of leaves) {
+          const consumer = byConsumer.get(row.consumer_id) ?? {
+            consumer_id: row.consumer_id,
+            receipts: [],
+            adjustmentReceipts: []
+          };
+          if (row.receipt_kind === "revision") consumer.receipts.push(clone(row.data));
+          else consumer.adjustmentReceipts.push(clone(row.data));
+          byConsumer.set(row.consumer_id, consumer);
+        }
+        const engaged = await client.query(
+          `SELECT DISTINCT consumer_id FROM adcp_reporting_consumer_statuses
+          WHERE obligation_id = $1 AND consumer_id <> '__legacy_unscoped_consumer__'
+          ORDER BY consumer_id LIMIT $2`,
+          [input.reporting_obligation_id, MAX_SNAPSHOT_ITEMS + 1]
+        );
+        if (engaged.rows.length > MAX_SNAPSHOT_ITEMS) {
+          receiptEvidenceComplete = false;
+          engaged.rows = engaged.rows.slice(0, MAX_SNAPSHOT_ITEMS);
+        }
+        const observed = [.../* @__PURE__ */ new Set([...byConsumer.keys(), ...engaged.rows.map((row) => row.consumer_id)])].sort();
+        const tombstoned = await this.listTombstonedAcceptedSubjects(
+          client,
+          { account_id: binding.account_id, consumer_id: void 0, view: "periods" },
+          [input.reporting_obligation_id],
+          true,
+          resolvedLedgerAsOf
+        );
+        if (!tombstoned.complete) receiptEvidenceComplete = false;
+        const visible = await client.query(
+          `SELECT adjustment_id FROM adcp_reporting_adjustments
+            WHERE obligation_id = $1 AND recorded_at <= $2::timestamptz
+            ORDER BY adjustment_number, adjustment_id LIMIT $3`,
+          [input.reporting_obligation_id, resolvedLedgerAsOf, MAX_SNAPSHOT_ITEMS + 1]
+        );
+        if (visible.rows.length > MAX_SNAPSHOT_ITEMS) receiptEvidenceComplete = false;
+        const visibleAdjustmentIds = visible.rows.slice(0, MAX_SNAPSHOT_ITEMS).map((row) => row.adjustment_id);
+        const visibleRevisions = await client.query(
+          `SELECT revision_id FROM adcp_reporting_revisions
+            WHERE obligation_id = $1 AND recorded_at <= $2::timestamptz
+            ORDER BY revision_number, revision_id LIMIT $3`,
+          [input.reporting_obligation_id, resolvedLedgerAsOf, MAX_SNAPSHOT_ITEMS + 1]
+        );
+        if (visibleRevisions.rows.length > MAX_SNAPSHOT_ITEMS) receiptEvidenceComplete = false;
+        const visibleRevisionIds = visibleRevisions.rows.slice(0, MAX_SNAPSHOT_ITEMS).map((row) => row.revision_id);
+        const tombstonedAcceptedSubjects = tombstoned.subjects;
+        const delivered = await client.query(
+          `SELECT revision_id FROM adcp_reporting_materialization_tombstones
+            WHERE obligation_id = $1 AND reached_success
+              AND COALESCE(reached_success_at, pruned_at) <= $3::timestamptz LIMIT $2`,
+          [input.reporting_obligation_id, MAX_SNAPSHOT_ITEMS + 1, resolvedLedgerAsOf]
+        );
+        if (delivered.rows.length > MAX_SNAPSHOT_ITEMS) receiptEvidenceComplete = false;
+        const tombstonedDeliveredRevisionIds = delivered.rows.slice(0, MAX_SNAPSHOT_ITEMS).map((row) => row.revision_id);
+        const managedStateVersion = await this.readManagedStateVersion(client, input.reporting_obligation_id);
+        return {
+          binding,
+          materializations,
+          materializationHistory,
+          consumers: [...byConsumer.values()],
+          obligatedConsumerIds: observed,
+          obligatedConsumerRosterComplete: false,
+          receiptEvidenceComplete,
+          visibleAdjustmentIds,
+          visibleRevisionIds,
+          managedStateVersion,
+          resolvedLedgerAsOf,
+          tombstonedAcceptedSubjects,
+          tombstonedDeliveredRevisionIds
+        };
+      },
+      { isolation: "REPEATABLE READ" }
+    );
+    if (!base || !this.obligatedConsumers) return base;
+    const supplied = await withReportingCallbackDeadline(
+      this.obligatedConsumers({
+        reporting_obligation_id: input.reporting_obligation_id,
+        account_id: base.binding.account_id
+      }),
+      OBLIGATED_CONSUMERS_DEADLINE_MS,
+      "Reporting obligated-consumer lookup deadline elapsed"
+    );
+    const all = obligatedConsumerIdsFor(supplied, base.obligatedConsumerIds ?? []);
+    const identityIds = supplied.version === void 0 && supplied.complete !== true ? obligatedConsumerIdsFor(supplied, await this.observedConsumerIds(input.reporting_obligation_id)) : all;
+    const ids = all.slice(0, MAX_SNAPSHOT_ITEMS);
+    const rosterComplete = supplied.complete === true && all.length === ids.length;
+    return {
+      ...base,
+      obligatedConsumerIds: ids,
+      obligatedConsumerRosterComplete: rosterComplete,
+      ...all.length === ids.length ? {} : { receiptEvidenceComplete: false },
+      obligatedConsumerRosterVersion: obligatedConsumerRosterVersionFor(supplied, identityIds)
+    };
+  }
+  /**
+   * Digest over every managed row that can change this obligation's projected
+   * health: materialization status, receipt existence and current-leaf flag,
+   * adjustments, and the destination authorization's revocation/cleanup state.
+   *
+   * `is_current` is included because superseding a receipt flips it with no
+   * timestamp of its own, and the authorization's `cleanup_completed_at` is
+   * included because `completeRevocation` does not touch `changed_at`.
+   */
+  async readManagedStateVersion(client, obligationId) {
+    const result = await client.query(
+      `SELECT md5(COALESCE(string_agg(marker, '|' ORDER BY marker), '')) AS version FROM (
+         SELECT 'm:' || materialization_id || ':' || status || ':'
+                || EXTRACT(EPOCH FROM changed_at)::text AS marker
+           FROM adcp_reporting_materializations WHERE obligation_id = $1
+         UNION ALL
+         -- Driven from this obligation's subjects into the receipt subject
+         -- index. This digest is read while the apply holds the account
+         -- lock, so asking the global receipt table which of its rows belong
+         -- to an obligation -- a question supplying neither account nor
+         -- consumer -- turned every apply into a full scan with that lock
+         -- held, and concurrent Core writes failed with 55P03.
+         SELECT 'r:' || receipt.reporting_receipt_id || ':' || receipt.is_current::text || ':'
+                || EXTRACT(EPOCH FROM receipt.recorded_at)::text
+           FROM adcp_reporting_revisions revision
+           JOIN adcp_reporting_receipts receipt
+             ON receipt.receipt_kind = 'revision' AND receipt.subject_id = revision.revision_id
+          WHERE revision.obligation_id = $1
+         UNION ALL
+         SELECT 'r:' || receipt.reporting_receipt_id || ':' || receipt.is_current::text || ':'
+                || EXTRACT(EPOCH FROM receipt.recorded_at)::text
+           FROM adcp_reporting_adjustments adjustment
+           JOIN adcp_reporting_receipts receipt
+             ON receipt.receipt_kind = 'adjustment' AND receipt.subject_id = adjustment.adjustment_id
+          WHERE adjustment.obligation_id = $1
+         UNION ALL
+         SELECT 'a:' || adjustment_id || ':' || EXTRACT(EPOCH FROM recorded_at)::text
+           FROM adcp_reporting_adjustments WHERE obligation_id = $1
+         UNION ALL
+         -- Consumer statuses are a health input through the mismatch
+         -- projection and they widen the observed roster, so a status landing
+         -- between projection and apply has to move the token too.
+         SELECT 'c:' || status.consumer_id || ':' || status.consumer_status_id || ':'
+                || status.is_current::text || ':' || EXTRACT(EPOCH FROM status.created_at)::text
+           FROM adcp_reporting_consumer_statuses status
+          WHERE status.obligation_id = $1
+         UNION ALL
+         SELECT 'z:' || authz.generation::text
+                || ':' || COALESCE(EXTRACT(EPOCH FROM authz.revoked_at)::text, '')
+                || ':' || COALESCE(EXTRACT(EPOCH FROM authz.cleanup_completed_at)::text, '')
+                || ':' || EXTRACT(EPOCH FROM authz.changed_at)::text
+           FROM adcp_reporting_destination_authorizations authz
+           JOIN adcp_reporting_managed_bindings binding
+             ON binding.account_id = authz.account_id AND binding.destination_ref = authz.destination_ref
+           JOIN adcp_reporting_obligations obligation
+             ON obligation.configuration_id = binding.configuration_id
+          WHERE obligation.obligation_id = $1
+       ) markers`,
+      [obligationId]
+    );
+    return result.rows[0]?.version ?? "";
+  }
+  /**
+   * Current external roster version, read outside any transaction so the
+   * reconciler can re-check it immediately before an apply.
+   */
+  /**
+   * Publishes the roster version currently observed for an obligation.
+   *
+   * The roster is external, so nothing in this database changes when it does.
+   * Recording what a reader saw is what lets the due query notice drift from
+   * the version last reconciled. Never lowers a watermark; it only reports.
+   */
+  async recordObligatedConsumerRosterVersion(input) {
+    await this.query(
+      `INSERT INTO adcp_reporting_lifecycle_state
+         (obligation_id, current_roster_version, roster_refreshed_at, processed_at)
+       VALUES ($1, $2, clock_timestamp(), clock_timestamp())
+       ON CONFLICT (obligation_id) DO UPDATE SET
+         current_roster_version = EXCLUDED.current_roster_version,
+         -- Advances the refresh cursor, never the reconciliation watermark:
+         -- observing a roster is not reconciling an obligation.
+         roster_refreshed_at = clock_timestamp()`,
+      [input.reporting_obligation_id, input.version]
+    );
+  }
+  /**
+   * Re-reads the external roster for managed obligations and publishes what
+   * it saw, so a change made while nothing was scheduled can re-arm.
+   *
+   * Ordered by least-recently-refreshed and bounded, so a large account is
+   * swept over successive passes rather than in one burst of callbacks.
+   */
+  async refreshObligatedConsumerRosterVersions(input) {
+    if (!this.managedDelivery || !this.obligatedConsumers) return 0;
+    positiveInteger(input.limit, "limit");
+    if (!await this.managedDueTablesReady()) return 0;
+    const budget = Math.min(input.limit, MAX_ROSTER_REFRESH_PER_SWEEP);
+    const candidates = await this.query(
+      `SELECT obligation.obligation_id
+         FROM adcp_reporting_obligations obligation
+         JOIN adcp_reporting_managed_bindings binding
+           ON binding.configuration_id = obligation.configuration_id
+         LEFT JOIN adcp_reporting_lifecycle_state state
+           ON state.obligation_id = obligation.obligation_id
+        WHERE ($1::text IS NULL OR obligation.account_id = $1)
+        -- Its own cursor, advanced by the refresh itself. Ordering by the
+        -- reconciliation watermark, which a refresh never moves, meant every
+        -- sweep re-read the same first page and nothing beyond one page of quiet
+        -- obligations was ever refreshed, so their roster changes could never
+        -- re-arm.
+        ORDER BY state.roster_refreshed_at NULLS FIRST, obligation.obligation_id
+        LIMIT $2`,
+      [input.account_id ?? null, budget]
+    );
+    let refreshed = 0;
+    for (const row of candidates.rows) {
+      try {
+        await this.readObligatedConsumerRosterVersion({ reporting_obligation_id: row.obligation_id });
+        refreshed += 1;
+      } catch {
+        await this.query(
+          `INSERT INTO adcp_reporting_lifecycle_state (obligation_id, roster_refreshed_at, processed_at)
+           VALUES ($1, clock_timestamp(), clock_timestamp())
+           ON CONFLICT (obligation_id) DO UPDATE SET roster_refreshed_at = clock_timestamp()`,
+          [row.obligation_id]
+        ).catch(() => void 0);
+      }
+    }
+    return refreshed;
+  }
+  /**
+   * Records a failed reconcile so the obligation backs off instead of
+   * re-occupying the head of every sweep, without ever hiding it: the
+   * watermark is untouched, so it stays unresolved work.
+   */
+  async recordLifecycleFailure(input) {
+    await this.query(
+      `INSERT INTO adcp_reporting_lifecycle_state (obligation_id, failure_count, next_attempt_at, processed_at)
+       VALUES ($1, 1, clock_timestamp() + INTERVAL '30 seconds', clock_timestamp())
+       ON CONFLICT (obligation_id) DO UPDATE SET
+         failure_count = adcp_reporting_lifecycle_state.failure_count + 1,
+         next_attempt_at = clock_timestamp() + (LEAST(
+           ${MAX_LIFECYCLE_BACKOFF_SECONDS}, 30 * POWER(2, LEAST(6, adcp_reporting_lifecycle_state.failure_count))
+         ) * INTERVAL '1 second')`,
+      [input.reporting_obligation_id]
+    );
+  }
+  /** Authoritative instant from the database clock, at microsecond precision. */
+  async readLedgerInstant() {
+    const result = await this.query(
+      `SELECT ${rfc3339Microseconds("clock_timestamp()")} AS instant`
+    );
+    return result.rows[0].instant;
+  }
+  async readObligatedConsumerRosterVersion(input) {
+    if (!this.managedDelivery || !this.obligatedConsumers) return void 0;
+    const accountId = await this.query(
+      "SELECT account_id FROM adcp_reporting_obligations WHERE obligation_id = $1",
+      [input.reporting_obligation_id]
+    );
+    const account_id = accountId.rows[0]?.account_id;
+    if (!account_id) return void 0;
+    const supplied = await withReportingCallbackDeadline(
+      this.obligatedConsumers({ reporting_obligation_id: input.reporting_obligation_id, account_id }),
+      OBLIGATED_CONSUMERS_DEADLINE_MS,
+      "Reporting obligated-consumer lookup deadline elapsed"
+    );
+    const observed = await this.observedConsumerIds(input.reporting_obligation_id);
+    const version = obligatedConsumerRosterVersionFor(supplied, obligatedConsumerIdsFor(supplied, observed));
+    await this.recordObligatedConsumerRosterVersion({
+      reporting_obligation_id: input.reporting_obligation_id,
+      version
+    });
+    return version;
+  }
+  /** Principals that have engaged with this obligation, as the projection sees them. */
+  async observedConsumerIds(obligationId) {
+    const result = await this.query(
+      `SELECT DISTINCT consumer_id FROM (
+         -- Driven from this obligation's subjects into the receipt subject
+         -- index, like every other obligation-scoped receipt read. Asking the
+         -- global receipt table which of its rows belong to an obligation
+         -- supplies neither account nor consumer, so the roster read scanned
+         -- the whole receipt history once per reconcile and once per
+         -- pre-apply re-check.
+         SELECT receipt.consumer_id
+           FROM adcp_reporting_revisions revision
+           JOIN adcp_reporting_receipts receipt
+             ON receipt.receipt_kind = 'revision' AND receipt.subject_id = revision.revision_id
+          WHERE revision.obligation_id = $1
+         UNION
+         SELECT receipt.consumer_id
+           FROM adcp_reporting_adjustments adjustment
+           JOIN adcp_reporting_receipts receipt
+             ON receipt.receipt_kind = 'adjustment' AND receipt.subject_id = adjustment.adjustment_id
+          WHERE adjustment.obligation_id = $1
+         UNION
+         SELECT status.consumer_id FROM adcp_reporting_consumer_statuses status
+          WHERE status.obligation_id = $1 AND status.consumer_id <> '__legacy_unscoped_consumer__'
+       ) engaged ORDER BY consumer_id`,
+      [obligationId]
+    );
+    return result.rows.map((row) => row.consumer_id);
+  }
+  managedDueTablesReadyCache;
+  /** Whether the managed schema exists, resolved once per store instance. */
+  managedDueTablesReady() {
+    if (!this.managedDelivery) return Promise.resolve(false);
+    this.managedDueTablesReadyCache ??= this.query(
+      `SELECT to_regclass('adcp_reporting_managed_bindings') IS NOT NULL
+          AND to_regclass('adcp_reporting_materializations') IS NOT NULL
+          AND to_regclass('adcp_reporting_receipts') IS NOT NULL AS ready`
+    ).then((result) => result.rows[0]?.ready === true).catch((cause) => {
+      this.managedDueTablesReadyCache = void 0;
+      throw cause;
+    });
+    return this.managedDueTablesReadyCache;
+  }
+  /**
+   * Terminal receipt subjects whose bodies have been pruned.
+   *
+   * The projection decides reconciliation from the receipt rows it can see,
+   * so once an accepted leaf ages out the subject looks unreconciled again
+   * and a settled billing period reopens. The tombstone is the only remaining
+   * proof, so the projection has to consult it.
+   */
+  async listTombstonedAcceptedSubjects(client, query, obligationIds, allConsumers = false, ledgerAsOf) {
+    if (!obligationIds.length || !query.consumer_id && !allConsumers) return { subjects: [], complete: true };
+    const result = await client.query(
+      `SELECT tombstone.receipt_kind, tombstone.subject_id, tombstone.consumer_id
+         FROM adcp_reporting_receipt_tombstones tombstone
+        WHERE tombstone.account_id = $1 AND ($2::text IS NULL OR tombstone.consumer_id = $2)
+          AND tombstone.status = 'accepted' AND tombstone.was_current
+          -- A conclusion still has a place in time. Applying every accepted
+          -- tombstone regardless of when its receipt was filed let a
+          -- historical projection settle a subject on an acceptance that had
+          -- not happened yet at its cutoff. Rows written before the column
+          -- existed fall back to pruned_at, which is never earlier, so the
+          -- fallback can only withhold a conclusion, never invent one.
+          AND ($5::timestamptz IS NULL
+               OR COALESCE(tombstone.subject_recorded_at, tombstone.pruned_at) <= $5::timestamptz)
+          AND ((tombstone.receipt_kind = 'revision' AND EXISTS (
+                  SELECT 1 FROM adcp_reporting_revisions revision
+                   WHERE revision.revision_id = tombstone.subject_id
+                     AND revision.obligation_id = ANY($3::text[])))
+            OR (tombstone.receipt_kind = 'adjustment' AND EXISTS (
+                  SELECT 1 FROM adcp_reporting_adjustments adjustment
+                   WHERE adjustment.adjustment_id = tombstone.subject_id
+                     AND adjustment.obligation_id = ANY($3::text[]))))
+        LIMIT $4`,
+      [
+        query.account_id,
+        allConsumers ? null : query.consumer_id,
+        obligationIds,
+        MAX_SNAPSHOT_ITEMS + 1,
+        ledgerAsOf ?? null
+      ]
+    );
+    const complete = result.rows.length <= MAX_SNAPSHOT_ITEMS;
+    return {
+      complete,
+      subjects: result.rows.slice(0, MAX_SNAPSHOT_ITEMS).map((row) => ({
+        kind: row.receipt_kind === "adjustment" ? "adjustment" : "revision",
+        subjectId: row.subject_id,
+        // Carried through deliberately. An acceptance belongs to the consumer
+        // that gave it, so a lifecycle fold that runs per consumer must not
+        // let A's pruned acceptance settle the obligation on B's behalf.
+        consumerId: row.consumer_id
+      }))
+    };
+  }
+  async managedTablesInstalled(client) {
+    const result = await client.query(
+      `SELECT to_regclass('adcp_reporting_managed_bindings') IS NOT NULL
+          AND to_regclass('adcp_reporting_materializations') IS NOT NULL
+          AND to_regclass('adcp_reporting_receipts') IS NOT NULL AS ready`
+    );
+    return result.rows[0]?.ready === true;
+  }
+  async listManagedChangedObligationIds(client, query, ledgerAsOf, changesAfter) {
+    const result = await client.query(
+      `SELECT DISTINCT changed.obligation_id FROM (
+         SELECT materialization.obligation_id
+           FROM adcp_reporting_materializations materialization
+          WHERE materialization.account_id = $1
+            AND GREATEST(materialization.recorded_at, materialization.changed_at) > $3
+            AND GREATEST(materialization.recorded_at, materialization.changed_at) <= $2
+         UNION ALL
+         SELECT COALESCE(revision.obligation_id, adjustment.obligation_id) AS obligation_id
+           FROM adcp_reporting_receipts receipt
+      LEFT JOIN adcp_reporting_revisions revision
+             ON receipt.receipt_kind = 'revision' AND revision.revision_id = receipt.subject_id
+      LEFT JOIN adcp_reporting_adjustments adjustment
+             ON receipt.receipt_kind = 'adjustment' AND adjustment.adjustment_id = receipt.subject_id
+          WHERE receipt.account_id = $1 AND receipt.consumer_id = $4
+            AND receipt.recorded_at > $3 AND receipt.recorded_at <= $2
+         UNION ALL
+         SELECT obligation.obligation_id
+           FROM adcp_reporting_destination_authorizations authz
+           JOIN adcp_reporting_managed_bindings binding
+             ON binding.account_id = authz.account_id
+            AND binding.destination_ref = authz.destination_ref
+            AND binding.authorization_generation = authz.generation
+           JOIN adcp_reporting_obligations obligation ON obligation.configuration_id = binding.configuration_id
+          WHERE authz.account_id = $1 AND authz.revoked_at IS NOT NULL
+            AND authz.changed_at > $3 AND authz.changed_at <= $2
+       ) changed WHERE changed.obligation_id IS NOT NULL`,
+      [query.account_id, ledgerAsOf, changesAfter, query.consumer_id ?? null]
+    );
+    return new Set(result.rows.map((row) => row.obligation_id));
+  }
+  async listSnapshotManagedBindings(client, configurationIds) {
+    if (!configurationIds.length) return [];
+    const result = await client.query(
+      `SELECT data FROM adcp_reporting_managed_bindings
+        WHERE configuration_id = ANY($1::text[]) ORDER BY configuration_id`,
+      [configurationIds]
+    );
+    return result.rows.map((row) => row.data);
+  }
+  async listSnapshotMaterializations(client, obligationIds, ledgerAsOf, changesAfter) {
+    if (!obligationIds.length) return [];
+    const result = await client.query(
+      `SELECT data FROM adcp_reporting_materializations
+        WHERE obligation_id = ANY($1::text[])
+          AND recorded_at <= $2
+          AND ($3::timestamptz IS NULL OR GREATEST(recorded_at, changed_at) > $3)
+        ORDER BY obligation_id, attempt, materialization_id
+        LIMIT $4`,
+      [obligationIds, ledgerAsOf, changesAfter ?? null, MAX_SNAPSHOT_ITEMS + 1]
+    );
+    return result.rows.map((row) => row.data);
+  }
+  async listSnapshotMaterializationProjection(client, obligationIds, ledgerAsOf) {
+    if (!obligationIds.length) return [];
+    const result = await client.query(
+      `SELECT materialization.data, authz.revoked_at
+         FROM adcp_reporting_materializations materialization
+         JOIN adcp_reporting_destination_authorizations authz
+           ON authz.account_id = materialization.account_id
+          AND authz.destination_ref = materialization.destination_ref
+          AND authz.generation = materialization.authorization_generation
+        WHERE materialization.obligation_id = ANY($1::text[])
+          AND materialization.recorded_at <= $2
+        ORDER BY materialization.obligation_id, materialization.attempt, materialization.materialization_id
+        LIMIT $3`,
+      [obligationIds, ledgerAsOf, MAX_SNAPSHOT_ITEMS + 1]
+    );
+    return result.rows.map((row) => {
+      if (!row.revoked_at || row.data.status !== "available" && row.data.status !== "delivered") return row.data;
+      return {
+        ...row.data,
+        status: "failed",
+        failed_at: row.revoked_at.toISOString(),
+        failure_code: "AUTHORIZATION_REVOKED"
+      };
+    });
+  }
+  async listSnapshotReceipts(client, query, obligationIds, ledgerAsOf, changesAfter, kind) {
+    if (!obligationIds.length || !query.consumer_id) return [];
+    const join = kind === "revision" ? "JOIN adcp_reporting_revisions subject ON subject.revision_id = receipt.subject_id" : "JOIN adcp_reporting_adjustments subject ON subject.adjustment_id = receipt.subject_id";
+    const result = await client.query(
+      `SELECT receipt.data FROM adcp_reporting_receipts receipt
+        ${join}
+        WHERE receipt.account_id = $1 AND receipt.consumer_id = $2
+          AND receipt.receipt_kind = $3 AND subject.obligation_id = ANY($4::text[])
+          AND receipt.recorded_at <= $5
+          AND ($6::timestamptz IS NULL OR receipt.recorded_at > $6)
+        ORDER BY subject.obligation_id, receipt.recorded_at, receipt.reporting_receipt_id
+        LIMIT $7`,
+      [
+        query.account_id,
+        query.consumer_id,
+        kind,
+        obligationIds,
+        ledgerAsOf,
+        changesAfter ?? null,
+        MAX_SNAPSHOT_ITEMS + 1
+      ]
+    );
+    return result.rows.map((row) => row.data);
+  }
   async one(sql, params) {
     const result = await this.query(sql, params);
     return result.rows[0] ? clone(result.rows[0].data) : null;
   }
-  async putImmutable(insertSql, insertParams, readSql, readParams, proposed, fingerprint, advisoryLock, leaseFence) {
+  async putImmutable(insertSql, insertParams, readSql, readParams, proposed, fingerprint, advisoryLock, leaseFence, legacyReplayEquivalent) {
     return this.transaction(
       async (client) => {
         const inserted = await client.query(insertSql, insertParams);
@@ -1606,7 +2501,7 @@ class PostgresReportingLedgerStore {
           }
           throw new Error("Immutable reporting ledger replay could not be resolved");
         }
-        if (fingerprint(value) !== fingerprint(proposed)) {
+        if (fingerprint(value) !== fingerprint(proposed) && !legacyReplayEquivalent?.(value, proposed)) {
           throw new Error("Immutable reporting ledger identity names different content");
         }
         return { inserted: inserted.rowCount === 1, value: clone(value) };
@@ -1718,6 +2613,38 @@ function snapshotItems(snapshot) {
     values.push(adjustment);
     adjustments.set(adjustment.reporting_obligation_id, values);
   }
+  const obligationByRevision = new Map(
+    snapshot.revisions.map((value) => [value.reporting_revision_id, value.reporting_obligation_id])
+  );
+  const obligationByAdjustment = new Map(
+    snapshot.adjustments.map((value) => [value.reporting_adjustment_id, value.reporting_obligation_id])
+  );
+  const materializations = /* @__PURE__ */ new Map();
+  for (const materialization of snapshot.materializations ?? []) {
+    if (snapshot.query.finality && !visibleRevisionIds.has(materialization.reporting_revision_id)) continue;
+    const values = materializations.get(materialization.reporting_obligation_id) ?? [];
+    values.push(materialization);
+    materializations.set(materialization.reporting_obligation_id, values);
+  }
+  const receipts = /* @__PURE__ */ new Map();
+  for (const receipt of snapshot.receipts ?? []) {
+    if (snapshot.query.finality && !visibleRevisionIds.has(receipt.reporting_revision_id)) continue;
+    const obligationId = obligationByRevision.get(receipt.reporting_revision_id);
+    if (!obligationId) continue;
+    const values = receipts.get(obligationId) ?? [];
+    values.push(receipt);
+    receipts.set(obligationId, values);
+  }
+  const adjustmentReceipts = /* @__PURE__ */ new Map();
+  const visibleAdjustmentIds = new Set([...adjustments.values()].flat().map((value) => value.reporting_adjustment_id));
+  for (const receipt of snapshot.adjustmentReceipts ?? []) {
+    if (snapshot.query.finality && !visibleAdjustmentIds.has(receipt.reporting_adjustment_id)) continue;
+    const obligationId = obligationByAdjustment.get(receipt.reporting_adjustment_id);
+    if (!obligationId) continue;
+    const values = adjustmentReceipts.get(obligationId) ?? [];
+    values.push(receipt);
+    adjustmentReceipts.set(obligationId, values);
+  }
   return [
     ...snapshot.obligations.flatMap((obligation) => [
       ...snapshot.query.view === "revision" ? [] : [{ kind: "obligation", value: obligation }],
@@ -1728,6 +2655,18 @@ function snapshotItems(snapshot) {
       ...(adjustments.get(obligation.reporting_obligation_id) ?? []).map((value) => ({
         kind: "adjustment",
         value
+      })),
+      ...(materializations.get(obligation.reporting_obligation_id) ?? []).map((value) => ({
+        kind: "materialization",
+        value
+      })),
+      ...(receipts.get(obligation.reporting_obligation_id) ?? []).map((value) => ({
+        kind: "receipt",
+        value
+      })),
+      ...(adjustmentReceipts.get(obligation.reporting_obligation_id) ?? []).map((value) => ({
+        kind: "adjustment_receipt",
+        value
       }))
     ]),
     ...snapshot.query.view === "periods" || snapshot.query.view === "revision" ? (snapshot.consumerStatuses ?? []).map((value) => ({ kind: "consumer_status", value })) : []
@@ -1808,9 +2747,200 @@ function adjustmentIdentityFingerprint(value) {
   const { created_at: _wireCreatedAt, ...stableWireAdjustment } = wireAdjustment;
   return digest(JSON.parse(JSON.stringify({ ...identity, wireAdjustment: stableWireAdjustment })));
 }
+function revisionLegacyCanonicalDigestReplay(stored, proposed) {
+  if (stored.wireRevision.canonical_content_digest !== void 0) return false;
+  if (proposed.wireRevision.canonical_content_digest === void 0) return false;
+  const { canonical_content_digest: _digest, ...withoutDigest } = proposed.wireRevision;
+  return revisionIdentityFingerprint({
+    ...proposed,
+    wireRevision: withoutDigest
+  }) === revisionIdentityFingerprint(stored);
+}
+function adjustmentLegacyCanonicalDigestReplay(stored, proposed) {
+  if (stored.wireAdjustment.canonical_adjustment_sha256 !== void 0) return false;
+  const proposedDigest = proposed.wireAdjustment.canonical_adjustment_sha256;
+  if (proposedDigest === void 0) return false;
+  const { canonical_adjustment_sha256: _digest, ...withoutDigest } = proposed.wireAdjustment;
+  if ((0, import_producer.reportingCanonicalAdjustmentSha256V1)(withoutDigest) !== proposedDigest) return false;
+  return adjustmentIdentityFingerprint({
+    ...proposed,
+    wireAdjustment: withoutDigest
+  }) === adjustmentIdentityFingerprint(stored);
+}
+const OBLIGATED_CONSUMERS_DEADLINE_MS = 1e4;
+async function withReportingCallbackDeadline(value, milliseconds, message) {
+  let timer;
+  try {
+    return await Promise.race([
+      value,
+      new Promise((_resolve, reject) => {
+        timer = setTimeout(() => reject(new Error(message)), milliseconds);
+      })
+    ]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+function pendingAtCutoff(value) {
+  const {
+    ready_at: _readyAt,
+    resource: _resource,
+    verification: _verification,
+    failed_at: _failedAt,
+    failure_code: _failureCode,
+    ...pending
+  } = clone(value);
+  return { ...pending, status: "pending" };
+}
+const MANAGED_DUE_ARM = `           OR (EXISTS (
+                 SELECT 1 FROM adcp_reporting_managed_bindings binding
+                  WHERE binding.configuration_id = obligation.configuration_id
+                    AND (
+                      -- A managed change after the last transition. Health is
+                      -- composed from managed state, but only Core evidence
+                      -- and the clock used to schedule a reconcile \u2014 so a
+                      -- settlement, revocation, receipt, consumer status or
+                      -- roster-visible change arriving after a complete left
+                      -- that complete persisted and webhooked forever while
+                      -- a live read of the same obligation degraded.
+                      EXISTS (
+                        SELECT 1 FROM adcp_reporting_materializations m
+                         WHERE m.obligation_id = obligation.obligation_id
+                           AND m.changed_at > watermark.since
+                           AND m.changed_at <= $2)
+                      OR EXISTS (
+                        -- Adjustments are managed health inputs too: after an
+                        -- accepted billing receipt, a correction makes the live
+                        -- read action_required while the persisted health and
+                        -- its webhook stayed complete.
+                        SELECT 1 FROM adcp_reporting_adjustments adj
+                         WHERE adj.obligation_id = obligation.obligation_id
+                           AND adj.recorded_at > watermark.since
+                           AND adj.recorded_at <= $2)
+                      OR EXISTS (
+                        SELECT 1 FROM adcp_reporting_destination_authorizations authz
+                         WHERE authz.account_id = binding.account_id
+                           AND authz.destination_ref = binding.destination_ref
+                           AND GREATEST(authz.changed_at, COALESCE(authz.cleanup_completed_at, authz.changed_at))
+                               > watermark.since
+                           AND authz.changed_at <= $2)
+                      -- Driven from this obligation's subjects into the
+                      -- receipt table's subject index. Asking the global
+                      -- receipt table which of its rows belong to this
+                      -- obligation supplied neither account nor consumer, so
+                      -- every candidate obligation in every sweep re-scanned
+                      -- the whole receipt history.
+                      OR EXISTS (
+                        SELECT 1 FROM adcp_reporting_revisions rv
+                          JOIN adcp_reporting_receipts receipt
+                            ON receipt.receipt_kind = 'revision'
+                           AND receipt.subject_id = rv.revision_id
+                         WHERE rv.obligation_id = obligation.obligation_id
+                           AND receipt.recorded_at > watermark.since
+                           AND receipt.recorded_at <= $2)
+                      OR EXISTS (
+                        SELECT 1 FROM adcp_reporting_adjustments aj
+                          JOIN adcp_reporting_receipts receipt
+                            ON receipt.receipt_kind = 'adjustment'
+                           AND receipt.subject_id = aj.adjustment_id
+                         WHERE aj.obligation_id = obligation.obligation_id
+                           AND receipt.recorded_at > watermark.since
+                           AND receipt.recorded_at <= $2)
+                      OR EXISTS (
+                        SELECT 1 FROM adcp_reporting_consumer_statuses status
+                         WHERE status.obligation_id = obligation.obligation_id
+                           AND status.created_at > watermark.since
+                           AND status.created_at <= $2)
+                      -- An external roster change writes nothing here at all,
+                      -- so the only durable trace is the version recorded at
+                      -- the last reconcile. A null one means never reconciled.
+                      OR state.processed_roster_version IS NULL
+                      -- A roster lives outside this database, so the only way
+                      -- a change can re-arm anything is if someone records
+                      -- it. Every read of the roster publishes the version it
+                      -- saw; a difference from what was last reconciled is a
+                      -- due condition. Without this the first reconcile made
+                      -- processed_roster_version non-null and no later roster
+                      -- change could ever schedule work again.
+                      OR state.current_roster_version IS DISTINCT FROM state.processed_roster_version
+                      -- A retained resource expiring is a health change with
+                      -- no row written anywhere, so nothing else can notice it.
+                      OR EXISTS (
+                        SELECT 1 FROM adcp_reporting_materializations m
+                         WHERE m.obligation_id = obligation.obligation_id
+                           AND m.status IN ('available', 'delivered')
+                           AND (m.data -> 'resource' ->> 'expires_at')::timestamptz <= $2
+                           AND (m.data -> 'resource' ->> 'expires_at')::timestamptz
+                               > watermark.since)
+                    )
+               ))
+`;
+function obligatedConsumerIdsFor(supplied, observed) {
+  return supplied.complete === true ? [...new Set(supplied.ids)].sort() : [.../* @__PURE__ */ new Set([...supplied.ids, ...observed])].sort();
+}
+function obligatedConsumerRosterVersionFor(supplied, ids) {
+  return supplied.version ?? digest({ ids, complete: supplied.complete === true });
+}
+const MAX_ROSTER_REFRESH_PER_SWEEP = 25;
+const MAX_LIFECYCLE_BACKOFF_SECONDS = 900;
+function rfc3339Microseconds(expression) {
+  return `to_char(${expression} AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US"Z"')`;
+}
 function accountLock(accountId) {
   return `adcp-reporting-account:${accountId}`;
 }
+async function resolveStoredFinalityBaseline(transaction, obligationId) {
+  const latest = await transaction.query(
+    `SELECT transition_id, data->>'finality' AS finality
+       FROM adcp_reporting_transitions
+      WHERE obligation_id = $1 ORDER BY transition_sequence DESC LIMIT 1
+      FOR UPDATE`,
+    [obligationId]
+  );
+  const previous = latest.rows[0];
+  if (!previous) return "none";
+  if (previous.finality) return previous.finality;
+  await transaction.query(
+    `UPDATE adcp_reporting_transitions
+        SET data = data || jsonb_build_object('finality', 'none')
+      WHERE transition_id = $1 AND NOT (data ? 'finality')`,
+    [previous.transition_id]
+  );
+  return "none";
+}
+async function assertNoLegacyPendingTransitions(transaction, obligationId) {
+  const pending = await transaction.query(
+    `SELECT transition_id FROM adcp_reporting_transitions
+      WHERE obligation_id = $1 AND data->>'notifiedAt' IS NULL
+      LIMIT 1`,
+    [obligationId]
+  );
+  if (pending.rowCount !== 0) {
+    throw new Error(
+      "Drain or explicitly resolve legacy pending reporting transitions before enabling transactional notification activity"
+    );
+  }
+}
+async function assertFinalityWriterFence(work) {
+  try {
+    return await work();
+  } catch (error) {
+    if (isFinalityWriterFenceViolation(error)) {
+      throw new Error(
+        "Reporting transition rejected by the finality writer fence: every transition written after REPORTING_LEDGER_FINALITY_WRITER_FENCE_MIGRATION must record an observed finality. Drain pre-SDK-14 writers before installing the fence.",
+        { cause: error }
+      );
+    }
+    throw error;
+  }
+}
+function isFinalityWriterFenceViolation(error) {
+  for (let current = error; current instanceof Error; current = current.cause) {
+    const candidate = current;
+    if (candidate.code === "23514" && candidate.constraint === REPORTING_LEDGER_FINALITY_FENCE_CONSTRAINT) return true;
+  }
+  return false;
+}
 function consumerStatusChainKeyForObligation(obligation) {
   return (0, import_consumer_status_identity.reportingConsumerStatusChainKeyFromIdentityV1)({
     delivery_config_id: obligation.delivery_config_id,
@@ -1891,6 +3021,8 @@ function positiveInteger(value, name) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   PostgresReportingLedgerStore,
+  REPORTING_LEDGER_FINALITY_FENCE_CONSTRAINT,
+  REPORTING_LEDGER_FINALITY_WRITER_FENCE_MIGRATION,
   REPORTING_LEDGER_MIGRATION,
   ReportingLedgerContinuityError,
   ReportingLedgerLeaseLostError,