@openlup/platform 0.23.0 → 0.25.0

package/sql/20261024180000_subscription_stock_wait.sql

@@ -0,0 +1,330 @@
+-- Frozen stock waits use native M06 availability and reservations. Resumed means
+-- paid realization admitted, never parcel arrival. No background consumer,
+-- payment executor, pause, replacement confirmation or automatic delivery fact.
+-- Disable the wait driver before rollback and retain captured obligations.
+-- Donor: supabase/migrations/20261003123000_subscription_stock_wait.sql (87-126,
+-- 260-298, 628-650), 20261003142320_subscription_stock_wait_unpaid_discovery.sql
+-- (20-23, 116-195). Uncaptured selection rotates on operation.updated_at.
+-- Native frozen recovery is pre-cycle only: operation snapshots
+-- replace the managed unpaid cycle/order/payment graph; provider-owned graphs refuse.
+CREATE TABLE public.subscription_stock_wait_cases (
+ id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+ subscription_id uuid NOT NULL REFERENCES public.subscriptions(id),
+ client_id uuid NOT NULL REFERENCES public.clients(id),
+ renewal_operation_id uuid NOT NULL UNIQUE REFERENCES public.subscription_renewal_operations(id),
+ scheduled_at timestamptz NOT NULL,
+ cycle_number integer NOT NULL CHECK (cycle_number>0),
+ state text NOT NULL CHECK (state IN ('waiting','stock_secured','resumed','closed')),
+ due_snapshot jsonb NOT NULL,
+ cycle_snapshot jsonb NOT NULL,
+ fingerprint text NOT NULL CHECK (fingerprint ~ '^[0-9a-f]{64}$'),
+ identity_key text NOT NULL,
+ deficits jsonb NOT NULL CHECK (jsonb_typeof(deficits)='array'),
+ notice_messages jsonb NOT NULL DEFAULT '{}',
+ refusal_observations jsonb NOT NULL DEFAULT '[]',
+ cycle_id uuid REFERENCES public.subscription_cycles(id),
+ order_id uuid REFERENCES public.commerce_orders(id),
+ fulfillment_id uuid REFERENCES public.fulfillment_shipments(id),
+ opened_at timestamptz NOT NULL DEFAULT now(),
+ last_checked_at timestamptz NOT NULL DEFAULT now(),
+ last_selected_at timestamptz,
+ stock_secured_at timestamptz,
+ resumed_at timestamptz,
+ closed_at timestamptz,
+ block_reason text,
+ CONSTRAINT subscription_stock_wait_schedule_key UNIQUE(subscription_id,scheduled_at)
+);
+-- squawk-ignore require-concurrent-index-creation
+CREATE INDEX subscription_stock_wait_candidates_idx ON public.subscription_stock_wait_cases(state,last_selected_at,id);
+REVOKE ALL ON TABLE public.subscription_stock_wait_cases FROM PUBLIC, anon, authenticated;
+CREATE FUNCTION public.subscription_stock_wait_projection(p_case public.subscription_stock_wait_cases)
+RETURNS jsonb LANGUAGE sql IMMUTABLE SET search_path = pg_catalog AS $$
+ SELECT to_jsonb(p_case)-'due_snapshot'-'cycle_snapshot'-'notice_messages';
+$$;
+CREATE FUNCTION public.subscription_stock_wait_read(p_case_id uuid)
+RETURNS jsonb LANGUAGE sql STABLE SET search_path = pg_catalog AS $$
+ SELECT public.subscription_stock_wait_projection(c)||jsonb_build_object('waitingNoticeRelevant',s.status='active' AND s.next_cycle_at=c.scheduled_at)
+ FROM public.subscription_stock_wait_cases c JOIN public.subscriptions s ON s.id=c.subscription_id WHERE c.id=p_case_id;
+$$;
+CREATE FUNCTION public.subscription_stock_wait_frozen(p_subscription_id uuid,p_scheduled_at timestamptz)
+RETURNS jsonb LANGUAGE sql STABLE SET search_path = pg_catalog AS $$
+ SELECT jsonb_build_object('caseId',c.id,'operationId',op.id,'identityKey',op.identity_key,
+  'operationFingerprint',op.operation_fingerprint,'snapshot',op.cycle_snapshot,'cycleNumber',op.cycle_number,
+  'binding',jsonb_build_object('caseId',c.id,'cycleId',cycle.id,'orderId',ord.id,'paymentId',intent.id,'engineIdempotencyKey',op.identity_key))
+ FROM public.subscription_renewal_operations op
+ LEFT JOIN public.subscription_stock_wait_cases c ON c.renewal_operation_id=op.id
+ LEFT JOIN public.subscription_cycles cycle ON cycle.renewal_operation_id=op.id
+ LEFT JOIN public.commerce_orders ord ON ord.renewal_operation_id=op.id
+ LEFT JOIN public.commerce_settlement_intents intent ON intent.renewal_operation_id=op.id
+ WHERE op.subscription_id=p_subscription_id AND op.scheduled_at=p_scheduled_at
+ AND EXISTS(SELECT 1 FROM public.subscriptions s WHERE s.id=op.subscription_id
+  AND s.status='active' AND s.next_cycle_at=p_scheduled_at)
+ AND op.attempt_prepared_at IS NULL AND op.external_attempt_ref IS NULL
+ AND cycle.id IS NULL AND ord.id IS NULL AND intent.id IS NULL
+ AND (c.id IS NULL OR c.state IN ('waiting','stock_secured'))
+ AND NOT EXISTS(SELECT 1 FROM public.subscription_renewal_outcomes outcome WHERE outcome.renewal_operation_id=op.id
+  AND (outcome.outcome<>'refused' OR outcome.reason NOT IN ('inventory_unavailable','reservation_expired') OR outcome.external_ref IS NOT NULL));
+$$;
+
+-- Credit the operation's live commitment exactly once, subtract every other
+-- commitment, and preserve the complete frozen basket in the wait ledger.
+CREATE FUNCTION public.subscription_stock_wait_deficits(p_snapshot jsonb,p_operation_id uuid,p_now timestamptz)
+RETURNS jsonb LANGUAGE plpgsql SET search_path = pg_catalog AS $$
+DECLARE line record; stock public.fulfillment_stock_current; required bigint; own_qty bigint;
+ available bigint; promise jsonb; result jsonb:='[]'; source text:=p_snapshot->>'stockSourceKey';
+BEGIN
+ IF jsonb_typeof(p_snapshot->'lines') IS DISTINCT FROM 'array' OR jsonb_array_length(p_snapshot->'lines')=0 OR source IS NULL THEN
+  RAISE EXCEPTION 'stock_wait_invalid_basket' USING ERRCODE='22023'; END IF;
+ PERFORM s.sku FROM public.fulfillment_stock_current s JOIN jsonb_array_elements(p_snapshot->'lines') l ON l->>'sku'=s.sku
+  WHERE s.source_key=source ORDER BY s.sku FOR UPDATE OF s;
+ FOR line IN SELECT l->>'sku' sku,sum((l->>'quantity')::integer) quantity FROM jsonb_array_elements(p_snapshot->'lines') l GROUP BY l->>'sku' ORDER BY l->>'sku' LOOP
+  required:=line.quantity;
+  IF required IS NULL OR required<1 OR btrim(COALESCE(line.sku,''))='' THEN RAISE EXCEPTION 'stock_wait_invalid_quantity'; END IF;
+  SELECT * INTO stock FROM public.fulfillment_stock_current WHERE source_key=source AND sku=line.sku;
+  IF stock.sku IS NULL THEN RAISE EXCEPTION 'stock_wait_stock_missing'; END IF;
+  IF stock.stale_after<=p_now THEN RAISE EXCEPTION 'stock_wait_stock_stale'; END IF;
+  SELECT COALESCE(sum(l.quantity),0) INTO own_qty
+   FROM public.fulfillment_inventory_reservations r JOIN public.fulfillment_inventory_reservation_lines l ON l.reservation_id=r.id
+   WHERE r.source_key=source AND l.sku=line.sku AND r.renewal_operation_id=p_operation_id
+    AND (r.status='committed' OR (r.status='held' AND r.expires_at>p_now));
+  promise:=public.inventory_available_to_promise(source,line.sku,p_now,true);
+  available:=CASE WHEN stock.inventory_class='sellable' THEN (promise->>'available_quantity')::bigint ELSE 0 END;
+  IF own_qty+available<required THEN
+   result:=result||jsonb_build_array(jsonb_build_object('sku',line.sku,'requiredUnits',required,'reservedUnits',own_qty,
+    'availableUnits',available,'missingUnits',required-own_qty-available));
+  END IF;
+ END LOOP;
+ RETURN result;
+END;
+$$;
+CREATE FUNCTION public.subscription_stock_wait_enqueue(p_case public.subscription_stock_wait_cases,p_kind text)
+RETURNS void LANGUAGE plpgsql SET search_path = pg_catalog AS $$
+BEGIN
+ IF p_kind NOT IN ('started','resumed') THEN RAISE EXCEPTION 'stock_wait_event_invalid'; END IF;
+ INSERT INTO public.outbox_events(aggregate_type,aggregate_id,event_type,idempotency_key,payload,metadata)
+ VALUES('subscription_stock_wait',p_case.id,'subscription_stock_wait.'||p_kind,'subscription_stock_wait:'||p_case.id::text||':'||p_kind,
+  jsonb_build_object('caseId',p_case.id,'clientId',p_case.client_id,'subscriptionId',p_case.subscription_id,
+   'scheduledAt',p_case.scheduled_at,'deficits',p_case.deficits,'orderId',p_case.order_id),jsonb_build_object('source','subscription_stock_wait'))
+ ON CONFLICT(event_type,idempotency_key) DO NOTHING;
+END;
+$$;
+
+-- This is a bounded stock-only reset. Stock-refusal observations are not payment
+-- outcomes; any other outcome or business artifact refuses before mutation.
+CREATE FUNCTION public.subscription_stock_wait_recover_refusal(p_operation_id uuid,p_fingerprint text,p_worker text,p_now timestamptz DEFAULT now())
+RETURNS jsonb LANGUAGE plpgsql SET search_path = pg_catalog AS $$
+DECLARE s public.subscriptions; op public.subscription_renewal_operations; c public.subscription_stock_wait_cases;
+ r public.fulfillment_inventory_reservations; deficits jsonb; token uuid:=gen_random_uuid();
+BEGIN
+ SELECT * INTO s FROM public.subscriptions WHERE id=(SELECT subscription_id FROM public.subscription_renewal_operations WHERE id=p_operation_id) FOR UPDATE;
+ SELECT * INTO op FROM public.subscription_renewal_operations WHERE id=p_operation_id FOR UPDATE;
+ SELECT * INTO c FROM public.subscription_stock_wait_cases WHERE renewal_operation_id=p_operation_id FOR UPDATE;
+ SELECT * INTO r FROM public.fulfillment_inventory_reservations WHERE renewal_operation_id=p_operation_id FOR UPDATE;
+ IF op.id IS NULL OR s.status<>'active' OR s.next_cycle_at IS DISTINCT FROM op.scheduled_at OR
+  op.operation_fingerprint IS DISTINCT FROM p_fingerprint OR btrim(COALESCE(p_worker,''))='' OR
+  (c.id IS NOT NULL AND (c.fingerprint<>op.operation_fingerprint OR c.cycle_snapshot<>op.cycle_snapshot OR c.identity_key<>op.identity_key OR c.state='closed')) THEN
+  RAISE EXCEPTION 'stock_wait_binding_changed' USING ERRCODE='22023'; END IF;
+ IF c.state='stock_secured' AND op.state='reserved' AND r.status='held' AND r.expires_at>p_now AND op.lease_expires_at>p_now THEN
+  RETURN public.subscription_renewal_operation_response(op,false,true,'stock_secured'); END IF;
+ IF NOT COALESCE(((op.state='refused' AND op.terminal_reason IN ('inventory_unavailable','reservation_expired')) OR
+  (op.state='reserved' AND c.state='stock_secured' AND r.status='held')),false) OR op.lease_expires_at>p_now OR
+  op.attempt_prepared_at IS NOT NULL OR op.external_attempt_ref IS NOT NULL OR op.external_attempt_acknowledged_at IS NOT NULL OR
+  EXISTS(SELECT 1 FROM public.subscription_cycles WHERE renewal_operation_id=op.id) OR
+  EXISTS(SELECT 1 FROM public.commerce_orders WHERE renewal_operation_id=op.id) OR
+  EXISTS(SELECT 1 FROM public.commerce_settlement_intents WHERE renewal_operation_id=op.id) OR
+  EXISTS(SELECT 1 FROM public.subscription_renewal_outcomes WHERE renewal_operation_id=op.id AND
+   (outcome<>'refused' OR reason IS NULL OR reason NOT IN ('inventory_unavailable','reservation_expired') OR external_ref IS NOT NULL
+    OR operation_fingerprint<>op.operation_fingerprint OR event_key NOT IN (op.identity_key||':inventory',op.identity_key||':reservation-expired'))) OR
+  (r.id IS NOT NULL AND (r.operation_fingerprint<>p_fingerprint OR r.source_key IS DISTINCT FROM op.cycle_snapshot->>'stockSourceKey' OR (r.status NOT IN ('expired','released') AND NOT (r.status='held' AND c.state='stock_secured')))) THEN
+  RAISE EXCEPTION 'stock_wait_recovery_provider_owned_or_not_eligible' USING ERRCODE='22023'; END IF;
+ deficits:=public.subscription_stock_wait_deficits(op.cycle_snapshot,op.id,p_now);
+ INSERT INTO public.subscription_stock_wait_cases(subscription_id,client_id,renewal_operation_id,scheduled_at,cycle_number,state,due_snapshot,cycle_snapshot,fingerprint,identity_key,deficits,opened_at,last_checked_at)
+ VALUES(s.id,s.client_id,op.id,op.scheduled_at,op.cycle_number,'waiting',to_jsonb(op),op.cycle_snapshot,op.operation_fingerprint,op.identity_key,deficits,p_now,p_now)
+ ON CONFLICT(subscription_id,scheduled_at) DO UPDATE SET deficits=EXCLUDED.deficits,last_checked_at=p_now RETURNING * INTO c;
+ IF jsonb_array_length(deficits)>0 THEN
+  UPDATE public.subscription_stock_wait_cases SET state='waiting',block_reason='inventory_unavailable' WHERE id=c.id RETURNING * INTO c;
+  PERFORM public.subscription_stock_wait_enqueue(c,'started');
+  RETURN jsonb_build_object('waiting',true,'caseId',c.id,'deficits',deficits);
+ END IF;
+ -- All effects inside this block roll back on a stock shortage. The wait row
+ -- remains outside it; prior commitments are never released to try another SKU.
+ BEGIN
+  -- The base stock rail uses one local refusal key per schedule/reason. Archive
+  -- those exact non-payment receipts before clearing them for this bounded
+  -- reset, so a later expiry can reuse the original key without a unique-key
+  -- failure. Provider/money outcomes are rejected above and never removed.
+  UPDATE public.subscription_stock_wait_cases SET refusal_observations=refusal_observations||
+   COALESCE((SELECT jsonb_agg(to_jsonb(observation) ORDER BY occurred_at,id) FROM public.subscription_renewal_outcomes observation WHERE renewal_operation_id=op.id),'[]'::jsonb)
+   WHERE id=c.id;
+  DELETE FROM public.subscription_renewal_outcomes WHERE renewal_operation_id=op.id;
+  UPDATE public.subscription_renewal_operations SET state='claimed',terminal_outcome=NULL,terminal_reason=NULL,terminal_at=NULL,
+   claim_token=token,claim_generation=claim_generation+1,claimed_by=p_worker,claimed_at=p_now,lease_expires_at=p_now+interval '5 minutes',updated_at=p_now WHERE id=op.id;
+  IF r.id IS NULL THEN
+   IF NOT (public.fulfillment_reserve_subscription_renewal(op.id,token,900,p_now)->>'reserved')::boolean THEN
+    RAISE EXCEPTION 'stock_wait_atomic_shortage' USING ERRCODE='23514'; END IF;
+  ELSE
+   -- Restore exactly the expired reservation's original frozen lines.
+   IF (SELECT jsonb_agg(jsonb_build_object('sku',sku,'quantity',quantity) ORDER BY sku) FROM public.fulfillment_inventory_reservation_lines WHERE reservation_id=r.id)
+    IS DISTINCT FROM (SELECT jsonb_agg(jsonb_build_object('sku',l->>'sku','quantity',(l->>'quantity')::integer) ORDER BY l->>'sku') FROM jsonb_array_elements(op.cycle_snapshot->'lines') l) THEN
+    RAISE EXCEPTION 'stock_wait_reservation_snapshot_mismatch'; END IF;
+   UPDATE public.fulfillment_inventory_reservations SET status='held',expires_at=p_now+interval '15 minutes',terminal_reason=NULL,updated_at=p_now WHERE id=r.id;
+   UPDATE public.subscription_renewal_operations SET state='reserved' WHERE id=op.id;
+  END IF;
+ EXCEPTION WHEN check_violation THEN
+  IF SQLERRM<>'stock_wait_atomic_shortage' THEN RAISE; END IF;
+  UPDATE public.subscription_stock_wait_cases SET block_reason='inventory_unavailable',state='waiting' WHERE id=c.id;
+  RETURN jsonb_build_object('waiting',true,'caseId',c.id);
+ END;
+ UPDATE public.subscription_stock_wait_cases SET state='stock_secured',deficits='[]',block_reason=NULL,
+  stock_secured_at=COALESCE(stock_secured_at,p_now),last_checked_at=p_now WHERE id=c.id;
+ SELECT * INTO op FROM public.subscription_renewal_operations WHERE id=op.id;
+ RETURN public.subscription_renewal_operation_response(op,true,false,'stock_secured')||jsonb_build_object('waiting',false,'caseId',c.id);
+END;
+$$;
+CREATE FUNCTION public.subscription_stock_wait_admit(p_input jsonb,p_due jsonb,p_now timestamptz DEFAULT now())
+RETURNS jsonb LANGUAGE plpgsql SET search_path = pg_catalog AS $$
+DECLARE frozen jsonb; op public.subscription_renewal_operations; result jsonb; c public.subscription_stock_wait_cases;
+BEGIN
+ SELECT * INTO op FROM public.subscription_renewal_operations WHERE id=(p_input->>'operationId')::uuid;
+ frozen:=public.subscription_stock_wait_frozen(op.subscription_id,op.scheduled_at);
+ IF frozen IS NULL OR frozen->'snapshot' IS DISTINCT FROM p_input->'snapshot' OR
+  frozen->>'operationFingerprint' IS DISTINCT FROM p_input->>'operationFingerprint' OR
+  frozen->>'identityKey' IS DISTINCT FROM p_input->>'identityKey' OR
+  (p_due ? 'stockWaitRecovery' AND frozen->'binding' IS DISTINCT FROM p_due->'stockWaitRecovery') THEN
+  RAISE EXCEPTION 'stock_wait_frozen_binding_changed' USING ERRCODE='23505'; END IF;
+ IF op.state='refused' OR (op.state='reserved' AND op.lease_expires_at<=p_now) THEN
+  RETURN public.subscription_stock_wait_recover_refusal(op.id,op.operation_fingerprint,p_input->>'worker',p_now);
+ END IF;
+ IF op.state='reserved' THEN RETURN public.subscription_renewal_operation_response(op,false,true,'stock_secured'); END IF;
+ result:=public.fulfillment_reserve_subscription_renewal(op.id,(p_input->>'claimToken')::uuid,900,p_now);
+ IF (result->>'reserved')::boolean THEN RETURN result||jsonb_build_object('waiting',false); END IF;
+ -- Record the wait immediately; lease expiry is still required before reset.
+ INSERT INTO public.subscription_stock_wait_cases(subscription_id,client_id,renewal_operation_id,scheduled_at,cycle_number,state,due_snapshot,cycle_snapshot,fingerprint,identity_key,deficits,opened_at,last_checked_at)
+ SELECT op.subscription_id,s.client_id,op.id,op.scheduled_at,op.cycle_number,'waiting',p_due,op.cycle_snapshot,
+  op.operation_fingerprint,op.identity_key,public.subscription_stock_wait_deficits(op.cycle_snapshot,op.id,p_now),p_now,p_now
+ FROM public.subscriptions s WHERE s.id=op.subscription_id
+ ON CONFLICT(subscription_id,scheduled_at) DO UPDATE SET last_checked_at=p_now RETURNING * INTO c;
+ PERFORM public.subscription_stock_wait_enqueue(c,'started');
+ RETURN result||jsonb_build_object('waiting',true,'caseId',c.id);
+END;
+$$;
+-- Discover refused schedules even without a prior wait row. Oldest selected
+-- waits rotate independently of the normal due cohort, preserving fairness.
+CREATE FUNCTION public.subscription_stock_wait_candidates(p_limit integer DEFAULT 50,p_now timestamptz DEFAULT now())
+RETURNS jsonb LANGUAGE plpgsql SET search_path = pg_catalog AS $$
+DECLARE result jsonb; row record;
+BEGIN
+ result:='[]';
+ FOR row IN SELECT op.id,op.subscription_id,op.scheduled_at,c.id case_id FROM public.subscription_renewal_operations op
+  JOIN public.subscriptions s ON s.id=op.subscription_id LEFT JOIN public.subscription_stock_wait_cases c ON c.renewal_operation_id=op.id
+  WHERE s.status='active' AND s.next_cycle_at=op.scheduled_at AND op.lease_expires_at<=p_now
+   AND ((op.state='refused' AND op.terminal_reason IN ('inventory_unavailable','reservation_expired')) OR (op.state='reserved' AND c.state='stock_secured'))
+   AND (c.id IS NULL OR c.state IN ('waiting','stock_secured'))
+   AND public.subscription_stock_wait_frozen(op.subscription_id,op.scheduled_at) IS NOT NULL
+  ORDER BY CASE WHEN c.id IS NULL THEN op.updated_at ELSE c.last_selected_at END NULLS FIRST,op.scheduled_at,op.id LIMIT LEAST(GREATEST(p_limit,1),500)
+ LOOP
+  IF public.subscription_stock_wait_frozen(row.subscription_id,row.scheduled_at) IS NOT NULL THEN
+   IF row.case_id IS NOT NULL THEN
+    UPDATE public.subscription_stock_wait_cases SET last_selected_at=p_now WHERE id=row.case_id;
+   ELSE
+    PERFORM 1 FROM public.subscription_renewal_operations WHERE id=row.id FOR UPDATE SKIP LOCKED;
+    IF NOT FOUND THEN CONTINUE; END IF;
+    UPDATE public.subscription_renewal_operations SET updated_at=p_now WHERE id=row.id;
+   END IF;
+   result:=result||jsonb_build_array(public.subscription_stock_wait_frozen(row.subscription_id,row.scheduled_at));
+  END IF;
+ END LOOP;
+ -- Superseded/cancelled unpaid waits close; provider-owned/paid cases never do.
+ UPDATE public.subscription_stock_wait_cases c SET state='closed',closed_at=p_now,block_reason='schedule_superseded'
+ FROM public.subscriptions s,public.subscription_renewal_operations op WHERE s.id=c.subscription_id AND op.id=c.renewal_operation_id
+  AND c.state IN ('waiting','stock_secured') AND (s.status='cancelled' OR s.next_cycle_at IS DISTINCT FROM c.scheduled_at)
+  AND op.attempt_prepared_at IS NULL AND op.external_attempt_ref IS NULL
+  AND NOT EXISTS(SELECT 1 FROM public.subscription_cycles WHERE renewal_operation_id=op.id);
+ RETURN result;
+END;
+$$;
+CREATE FUNCTION public.subscription_stock_wait_normal_due(p_limit integer DEFAULT 50,p_now timestamptz DEFAULT now())
+RETURNS jsonb LANGUAGE sql STABLE SET search_path = pg_catalog AS $$
+ SELECT COALESCE(jsonb_agg(to_jsonb(d) ORDER BY d.scheduled_at,d.subscription_id),'[]'::jsonb) FROM (
+  SELECT subscription.id AS subscription_id, subscription.client_id, subscription.next_cycle_at AS scheduled_at,
+         subscription.cadence_days, terms.next_cycle_number AS cycle_number, terms.currency_code,
+         terms.stock_source_key, terms.settlement_channel_key, terms.authorization_ref,
+         terms.payer_account_ref, terms.unattended_charge_authorized_at, terms.delivery_admission,
+         terms.delivery_block_reason
+    FROM public.subscriptions subscription
+    JOIN public.subscription_renewal_terms terms ON terms.subscription_id=subscription.id
+   WHERE subscription.status='active' AND subscription.next_cycle_at IS NOT NULL
+     AND subscription.next_cycle_at<=COALESCE(p_now,now())
+     AND NOT EXISTS(SELECT 1 FROM public.subscription_renewal_operations operation
+      WHERE operation.subscription_id=subscription.id AND operation.scheduled_at=subscription.next_cycle_at
+       AND (operation.state IN ('succeeded','refused') OR operation.lease_expires_at>COALESCE(p_now,now())))
+     AND NOT EXISTS(SELECT 1 FROM public.subscription_stock_wait_cases c
+      WHERE c.subscription_id=subscription.id AND c.scheduled_at=subscription.next_cycle_at AND c.state IN ('waiting','stock_secured'))
+   ORDER BY subscription.next_cycle_at,subscription.id LIMIT LEAST(GREATEST(COALESCE(p_limit,50),1),500)
+ ) d;
+$$;
+CREATE FUNCTION public.subscription_stock_wait_mark_resumed(p_order_id uuid)
+RETURNS jsonb LANGUAGE plpgsql SET search_path = pg_catalog AS $$
+DECLARE c public.subscription_stock_wait_cases; shipment public.fulfillment_shipments;
+BEGIN
+ PERFORM 1 FROM public.subscriptions WHERE id=(SELECT subscription_id FROM public.subscription_stock_wait_cases WHERE renewal_operation_id=(SELECT renewal_operation_id FROM public.commerce_orders WHERE id=p_order_id)) FOR UPDATE;
+ SELECT * INTO c FROM public.subscription_stock_wait_cases WHERE renewal_operation_id=(SELECT renewal_operation_id FROM public.commerce_orders WHERE id=p_order_id) FOR UPDATE;
+ IF c.id IS NULL THEN RETURN NULL; END IF;
+ SELECT * INTO shipment FROM public.fulfillment_shipments WHERE order_id=p_order_id AND replaces_shipment_id IS NULL ORDER BY id LIMIT 1 FOR UPDATE;
+ IF c.state='closed' OR EXISTS(SELECT 1 FROM public.commerce_orders WHERE id=p_order_id AND status='pending_payment') THEN RETURN NULL; END IF;
+ IF NOT EXISTS(SELECT 1 FROM public.commerce_orders WHERE id=p_order_id AND status IN ('paid','fulfillment_pending','fulfilled')) OR
+  NOT EXISTS(SELECT 1 FROM public.commerce_settlement_intents WHERE order_id=p_order_id AND status='settled') OR
+  NOT EXISTS(SELECT 1 FROM public.subscription_cycles WHERE renewal_operation_id=c.renewal_operation_id AND status='paid') OR
+  NOT EXISTS(SELECT 1 FROM public.fulfillment_inventory_reservations WHERE renewal_operation_id=c.renewal_operation_id AND status='consumed') OR
+  shipment.id IS NULL OR shipment.status IN ('cancelled','exception') OR
+  EXISTS(SELECT 1 FROM public.commerce_order_holds WHERE order_id=p_order_id AND status='active') THEN
+  RAISE EXCEPTION 'stock_wait_realization_admission_missing' USING ERRCODE='22023'; END IF;
+ IF c.state='resumed' THEN
+  IF c.fulfillment_id IS DISTINCT FROM shipment.id THEN RAISE EXCEPTION 'stock_wait_fulfillment_replay_mismatch'; END IF;
+  RETURN public.subscription_stock_wait_projection(c);
+ END IF;
+ IF c.state<>'stock_secured' THEN RAISE EXCEPTION 'stock_wait_stock_not_secured'; END IF;
+ UPDATE public.subscription_stock_wait_cases SET state='resumed',resumed_at=now(),cycle_id=(SELECT subscription_cycle_id FROM public.commerce_orders WHERE id=p_order_id),
+  order_id=p_order_id,fulfillment_id=shipment.id WHERE id=c.id RETURNING * INTO c;
+ PERFORM public.subscription_stock_wait_enqueue(c,'resumed');
+ RETURN public.subscription_stock_wait_projection(c);
+END;
+$$;
+CREATE FUNCTION public.subscription_stock_wait_summary(p_state text)
+RETURNS jsonb LANGUAGE plpgsql STABLE SET search_path = pg_catalog AS $$
+BEGIN
+ IF p_state NOT IN ('all','waiting','stock_secured','resumed','closed') THEN RAISE EXCEPTION 'stock_wait_summary_state_invalid'; END IF;
+ RETURN jsonb_build_object('totalCount',(SELECT count(*) FROM public.subscription_stock_wait_cases WHERE p_state='all' OR state=p_state),
+ 'productTotals',COALESCE((SELECT jsonb_agg(to_jsonb(t)) FROM (SELECT l->>'sku' sku,sum((l->>'missingUnits')::bigint) missing_units,
+ count(DISTINCT c.id) affected_cases FROM public.subscription_stock_wait_cases c CROSS JOIN LATERAL jsonb_array_elements(c.deficits) l
+ WHERE p_state='all' OR c.state=p_state GROUP BY l->>'sku') t),'[]'::jsonb));
+END;
+$$;
+CREATE FUNCTION public.subscription_stock_wait_bind_notice(p_case_id uuid,p_event_id uuid,p_message jsonb)
+RETURNS jsonb LANGUAGE plpgsql SET search_path = pg_catalog AS $$
+DECLARE c public.subscription_stock_wait_cases; existing jsonb;
+BEGIN
+ SELECT * INTO c FROM public.subscription_stock_wait_cases WHERE id=p_case_id FOR UPDATE;
+ IF c.id IS NULL OR NOT EXISTS(SELECT 1 FROM public.outbox_events WHERE id=p_event_id AND aggregate_id=c.id
+  AND aggregate_type='subscription_stock_wait' AND event_type IN ('subscription_stock_wait.started','subscription_stock_wait.resumed')) THEN
+  RAISE EXCEPTION 'stock_wait_notice_binding_invalid'; END IF;
+ existing:=c.notice_messages->p_event_id::text;
+ IF existing IS NOT NULL THEN RETURN existing; END IF;
+ IF jsonb_typeof(p_message) IS DISTINCT FROM 'object' OR EXISTS(SELECT 1 FROM unnest(ARRAY['from','to','subject','html']) k WHERE btrim(COALESCE(p_message->>k,''))='') THEN
+  RAISE EXCEPTION 'stock_wait_notice_message_invalid'; END IF;
+ UPDATE public.subscription_stock_wait_cases SET notice_messages=jsonb_set(notice_messages,ARRAY[p_event_id::text],p_message) WHERE id=c.id;
+ RETURN p_message;
+END;
+$$;
+REVOKE ALL ON FUNCTION public.subscription_stock_wait_projection(public.subscription_stock_wait_cases) FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.subscription_stock_wait_read(uuid) FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.subscription_stock_wait_frozen(uuid,timestamptz) FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.subscription_stock_wait_deficits(jsonb,uuid,timestamptz) FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.subscription_stock_wait_enqueue(public.subscription_stock_wait_cases,text) FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.subscription_stock_wait_admit(jsonb,jsonb,timestamptz) FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.subscription_stock_wait_candidates(integer,timestamptz) FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.subscription_stock_wait_normal_due(integer,timestamptz) FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.subscription_stock_wait_mark_resumed(uuid) FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.subscription_stock_wait_summary(text) FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.subscription_stock_wait_bind_notice(uuid,uuid,jsonb) FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.subscription_stock_wait_recover_refusal(uuid,text,text,timestamptz) FROM PUBLIC, anon, authenticated;

package/sql/20261024183000_inventory_available_to_promise.sql

@@ -0,0 +1,70 @@
+-- Donor: supabase/migrations/20260928170000_new_purchase_stock_availability.sql (26-76).
+-- Native provider-stock subset: no lots/safety/excluded order; channel exposure is deferred.
+-- M06 observed-stock ATP. Native stock has no separate safety balance.
+-- Admission callers keep their stock-row locks; this is a read, not a hold.
+-- Only actual native renewal allocation skips the fixed 14-day soft priority.
+CREATE FUNCTION public.inventory_channel_exposure_quantity(p_source_key text, p_sku text)
+RETURNS jsonb LANGUAGE sql STABLE SET search_path = pg_catalog AS $$
+ SELECT '0'::jsonb;
+$$;
+REVOKE ALL ON FUNCTION public.inventory_channel_exposure_quantity(text,text) FROM PUBLIC, anon, authenticated;
+
+CREATE FUNCTION public.inventory_available_to_promise(
+ p_source_key text, p_sku text, p_as_of timestamptz, p_for_subscription_renewal boolean
+)
+RETURNS jsonb LANGUAGE sql STABLE SET search_path = pg_catalog AS $$
+ WITH live_holds AS (
+  SELECT r.renewal_operation_id,l.quantity
+  FROM public.fulfillment_inventory_reservations r
+  JOIN public.fulfillment_inventory_reservation_lines l ON l.reservation_id=r.id
+  WHERE r.source_key=p_source_key AND l.sku=p_sku
+   AND (r.status='committed' OR (r.status='held' AND r.expires_at>p_as_of))
+ ), components AS (
+  SELECT COALESCE((SELECT stock.for_sale_quantity FROM public.fulfillment_stock_current stock
+    WHERE stock.source_key=p_source_key AND stock.sku=p_sku
+     AND stock.inventory_class='sellable' AND stock.stale_after>p_as_of),0)::bigint for_sale,
+   (SELECT COALESCE(sum(quantity),0) FROM live_holds)::bigint hard_holds,
+   (SELECT COALESCE(sum(GREATEST(0,due.quantity-credited.quantity)),0)::bigint
+    FROM (
+     SELECT s.id,s.next_cycle_at,sum(l.quantity) quantity
+     FROM public.subscriptions s
+     JOIN public.subscription_renewal_terms t ON t.subscription_id=s.id
+     JOIN public.subscription_renewal_term_lines l ON l.subscription_id=s.id
+     WHERE s.status='active' AND s.next_cycle_at<=p_as_of+interval '14 days'
+      AND t.stock_source_key=p_source_key AND l.sku=p_sku
+     GROUP BY s.id,s.next_cycle_at
+    ) due CROSS JOIN LATERAL (
+     SELECT COALESCE(sum(h.quantity),0) quantity FROM live_holds h
+     JOIN public.subscription_renewal_operations op ON op.id=h.renewal_operation_id
+     WHERE op.subscription_id=due.id AND op.scheduled_at=due.next_cycle_at
+      AND NOT EXISTS(SELECT 1 FROM public.subscription_cycles c
+       WHERE c.renewal_operation_id=op.id AND c.status IN ('paid','skipped','cancelled'))
+    ) credited) soft_demand,
+   (public.inventory_channel_exposure_quantity(p_source_key,p_sku)#>>'{}')::bigint exposure
+ )
+ SELECT jsonb_build_object('available_quantity',GREATEST(0,for_sale-hard_holds
+   -CASE WHEN p_for_subscription_renewal IS TRUE THEN 0 ELSE soft_demand END-exposure),
+  'for_sale_quantity',for_sale,'hard_hold_quantity',hard_holds,'safety_quantity',0,
+  'soft_subscription_demand_quantity',soft_demand,'channel_exposure_quantity',exposure)
+ FROM components;
+$$;
+REVOKE ALL ON FUNCTION public.inventory_available_to_promise(text,text,timestamptz,boolean) FROM PUBLIC, anon, authenticated;
+
+-- M06 parity completion. Both availability fields protect subscription demand;
+-- this one-time-purchase read never accepts a caller-supplied renewal exemption.
+CREATE FUNCTION public.inventory_new_purchase_stock_read(p_source_key text, p_skus jsonb, p_as_of timestamptz)
+RETURNS jsonb LANGUAGE sql STABLE SET search_path = pg_catalog AS $$
+ SELECT COALESCE(jsonb_agg(jsonb_build_object('sku',requested.sku,'catalogSkuId',sku.id,
+  'source',CASE WHEN stock.sku IS NULL THEN 'missing' ELSE 'provider' END,
+  'providerForSale',stock.for_sale_quantity,'activeHolds',atp->'hard_hold_quantity',
+  'safetyStock',atp->'safety_quantity','available',atp->'available_quantity',
+  'stale',stock.sku IS NOT NULL AND stock.stale_after<=p_as_of,
+  'renewalDemand',atp->'soft_subscription_demand_quantity',
+  'availableForNewPurchases',atp->'available_quantity','excludedOrderHolds',0,
+  'channelExposure',atp->'channel_exposure_quantity') ORDER BY requested.sku),'[]'::jsonb)
+ FROM (SELECT DISTINCT value sku FROM jsonb_array_elements_text(p_skus)) requested
+ LEFT JOIN public.catalog_skus sku ON sku.sku=requested.sku
+ LEFT JOIN public.fulfillment_stock_current stock ON stock.source_key=p_source_key AND stock.sku=requested.sku
+ CROSS JOIN LATERAL (SELECT public.inventory_available_to_promise(p_source_key,requested.sku,p_as_of,false) atp) promise;
+$$;
+REVOKE ALL ON FUNCTION public.inventory_new_purchase_stock_read(text,jsonb,timestamptz) FROM PUBLIC, anon, authenticated;

package/sql/20261024184000_subscription_renewal_reserve_uses_seam.sql

@@ -0,0 +1,147 @@
+-- Donor: supabase/migrations/20260710131002_no_cron_inventory_reservation_leases.sql
+-- (inventory_reserve_order provider branch); native operation/claim receipts replace managed order holds.
+CREATE OR REPLACE FUNCTION public.fulfillment_reserve_subscription_renewal(
+  p_operation_id uuid,
+  p_claim_token uuid,
+  p_hold_seconds integer DEFAULT 900,
+  p_now timestamptz DEFAULT now()
+)
+RETURNS jsonb
+LANGUAGE plpgsql
+SET search_path = pg_catalog
+AS $$
+DECLARE
+  v_operation public.subscription_renewal_operations%ROWTYPE;
+  v_reservation public.fulfillment_inventory_reservations%ROWTYPE;
+  v_line jsonb;
+  v_source text;
+  v_sku text;
+  v_quantity integer;
+  v_available integer;
+BEGIN
+  IF p_operation_id IS NULL OR p_claim_token IS NULL
+    OR p_hold_seconds IS NULL OR p_hold_seconds NOT BETWEEN 60 AND 86400
+  THEN
+    RAISE EXCEPTION 'fulfillment_renewal_reservation_invalid_input' USING ERRCODE = '22023';
+  END IF;
+
+  SELECT * INTO v_operation FROM public.subscription_renewal_operations
+   WHERE id = p_operation_id FOR UPDATE;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'fulfillment_renewal_reservation_operation_not_found' USING ERRCODE = '22023';
+  END IF;
+  IF v_operation.claim_token <> p_claim_token
+    OR v_operation.lease_expires_at <= COALESCE(p_now, now())
+  THEN
+    RAISE EXCEPTION 'fulfillment_renewal_reservation_stale_claim' USING ERRCODE = '40001';
+  END IF;
+
+  SELECT * INTO v_reservation FROM public.fulfillment_inventory_reservations
+   WHERE renewal_operation_id = p_operation_id FOR UPDATE;
+  IF FOUND THEN
+    IF v_reservation.operation_fingerprint <> v_operation.operation_fingerprint THEN
+      RAISE EXCEPTION 'fulfillment_renewal_reservation_fingerprint_conflict' USING ERRCODE = '23505';
+    END IF;
+    IF v_reservation.status = 'held'
+      AND v_reservation.expires_at <= COALESCE(p_now, now())
+      AND v_operation.state = 'reserved'
+    THEN
+      UPDATE public.fulfillment_inventory_reservations
+         SET status = 'expired', expires_at = NULL,
+             terminal_reason = 'reservation_expired', updated_at = COALESCE(p_now, now())
+       WHERE id = v_reservation.id
+       RETURNING * INTO v_reservation;
+      UPDATE public.subscription_renewal_operations
+         SET state = 'refused', terminal_outcome = 'refused',
+             terminal_reason = 'reservation_expired', terminal_at = COALESCE(p_now, now()),
+             updated_at = COALESCE(p_now, now())
+       WHERE id = p_operation_id RETURNING * INTO v_operation;
+      INSERT INTO public.subscription_renewal_outcomes (
+        renewal_operation_id, operation_fingerprint, event_key, outcome, reason, occurred_at
+      ) VALUES (
+        p_operation_id, v_operation.operation_fingerprint,
+        v_operation.identity_key || ':reservation-expired', 'refused',
+        'reservation_expired', COALESCE(p_now, now()));
+      RETURN jsonb_build_object(
+        'reserved', false, 'replayed', true, 'reservationId', v_reservation.id,
+        'status', 'expired', 'reason', 'reservation_expired');
+    END IF;
+    RETURN jsonb_build_object(
+      'reserved', v_reservation.status IN ('held', 'committed', 'consumed'),
+      'replayed', true, 'reservationId', v_reservation.id,
+      'status', v_reservation.status, 'reason', v_reservation.terminal_reason);
+  END IF;
+
+  IF v_operation.state <> 'claimed' THEN
+    RAISE EXCEPTION 'fulfillment_renewal_reservation_invalid_state' USING ERRCODE = '22023';
+  END IF;
+  v_source := v_operation.cycle_snapshot->>'stockSourceKey';
+  IF v_source IS NULL OR v_source !~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$' THEN
+    RAISE EXCEPTION 'fulfillment_renewal_reservation_invalid_snapshot' USING ERRCODE = '22023';
+  END IF;
+
+  -- Lock all stock rows in a deterministic order before computing ATP, so two different
+  -- operations containing the same SKUs cannot both spend the same observed availability.
+  PERFORM stock.sku
+    FROM public.fulfillment_stock_current stock
+    JOIN jsonb_array_elements(v_operation.cycle_snapshot->'lines') line
+      ON stock.source_key = v_source AND stock.sku = line->>'sku'
+   ORDER BY stock.sku
+   FOR UPDATE OF stock;
+
+  FOR v_line IN SELECT value FROM jsonb_array_elements(v_operation.cycle_snapshot->'lines')
+  LOOP
+    v_sku := v_line->>'sku';
+    BEGIN v_quantity := (v_line->>'quantity')::integer;
+    EXCEPTION WHEN invalid_text_representation OR numeric_value_out_of_range THEN
+      RAISE EXCEPTION 'fulfillment_renewal_reservation_invalid_snapshot' USING ERRCODE = '22023';
+    END;
+    IF btrim(COALESCE(v_sku, '')) = '' OR v_quantity < 1 THEN
+      RAISE EXCEPTION 'fulfillment_renewal_reservation_invalid_snapshot' USING ERRCODE = '22023';
+    END IF;
+
+    SELECT (public.inventory_available_to_promise(v_source,v_sku,COALESCE(p_now,now()),true)
+      ->>'available_quantity')::integer INTO v_available;
+    IF v_available < v_quantity THEN
+      UPDATE public.subscription_renewal_operations
+         SET state = 'refused', terminal_outcome = 'refused',
+             terminal_reason = 'inventory_unavailable', terminal_at = COALESCE(p_now, now()),
+             updated_at = COALESCE(p_now, now())
+       WHERE id = p_operation_id RETURNING * INTO v_operation;
+      INSERT INTO public.subscription_renewal_outcomes (
+        renewal_operation_id, operation_fingerprint, event_key, outcome, reason, occurred_at
+      ) VALUES (
+        p_operation_id, v_operation.operation_fingerprint,
+        v_operation.identity_key || ':inventory', 'refused', 'inventory_unavailable',
+        COALESCE(p_now, now()));
+      RETURN jsonb_build_object(
+        'reserved', false, 'replayed', false, 'reservationId', NULL,
+        'status', 'refused', 'reason', 'inventory_unavailable');
+    END IF;
+  END LOOP;
+
+  INSERT INTO public.fulfillment_inventory_reservations (
+    renewal_operation_id, operation_fingerprint, source_key, expires_at, created_at, updated_at
+  ) VALUES (
+    p_operation_id, v_operation.operation_fingerprint, v_source,
+    COALESCE(p_now, now()) + make_interval(secs => p_hold_seconds),
+    COALESCE(p_now, now()), COALESCE(p_now, now())
+  ) RETURNING * INTO v_reservation;
+
+  FOR v_line IN SELECT value FROM jsonb_array_elements(v_operation.cycle_snapshot->'lines')
+  LOOP
+    INSERT INTO public.fulfillment_inventory_reservation_lines (
+      reservation_id, operation_fingerprint, sku, quantity
+    ) VALUES (
+      v_reservation.id, v_operation.operation_fingerprint,
+      v_line->>'sku', (v_line->>'quantity')::integer);
+  END LOOP;
+
+  UPDATE public.subscription_renewal_operations
+     SET state = 'reserved', updated_at = COALESCE(p_now, now())
+   WHERE id = p_operation_id;
+  RETURN jsonb_build_object(
+    'reserved', true, 'replayed', false, 'reservationId', v_reservation.id,
+    'status', 'held', 'reason', NULL);
+END;
+$$;

package/sql/20261024184500_subscription_retry_late_positive_stock.sql

@@ -0,0 +1,59 @@
+-- Donor: supabase/migrations/20261009110000_subscription_dunning_active_repair.sql
+-- (payment-result recovery). Native released-to-committed ATP accounting has no managed row-state twin.
+-- Native CTL-2 X: verified waiting-state late payment restores the original
+-- released reservation as an ATP-counted committed hold, without a new charge.
+-- Requires the native N1/N2/N3, 20261024183000 ATP seam and 20261024184000 allocator prefix.
+-- Body-only replacement: original signature, invoker rights, search_path and
+-- effective ACLs remain unchanged; no grants, tables, seeds or driver activation.
+-- Prepared/committed recovery retains its existing consumed transition. A restored
+-- hold remains counted until an explicit fulfillment/inventory reconciliation.
+-- Native only; no managed twin is installed. Keep this forward on code rollback.
+CREATE OR REPLACE FUNCTION public.subscription_retry_record_recovery(p_operation_id uuid,p_key text,p_input jsonb)
+RETURNS jsonb LANGUAGE plpgsql SET search_path = pg_catalog AS $$
+DECLARE o public.subscription_retry_obligations; r public.subscription_retry_receipts; prep public.subscription_retry_receipts;
+ i public.commerce_settlement_intents; result jsonb; at_time timestamptz:=(p_input->>'occurredAt')::timestamptz;
+BEGIN
+ PERFORM 1 FROM public.subscriptions WHERE id=(SELECT subscription_id FROM public.subscription_renewal_operations WHERE id=p_operation_id) FOR UPDATE;
+ SELECT * INTO o FROM public.subscription_retry_obligations WHERE renewal_operation_id=p_operation_id FOR UPDATE;
+ SELECT * INTO r FROM public.subscription_retry_receipts WHERE receipt_key=p_key;
+ IF r.id IS NOT NULL THEN
+  IF r.obligation_id<>o.id OR r.kind<>'recovery' OR r.input<>p_input THEN RAISE EXCEPTION 'subscription_retry_replay_conflict' USING ERRCODE='23505'; END IF;
+  RETURN r.result;
+ END IF;
+ SELECT * INTO i FROM public.commerce_settlement_intents WHERE id=o.settlement_intent_id FOR UPDATE;
+ SELECT * INTO prep FROM public.subscription_retry_receipts WHERE obligation_id=o.id AND kind='prepare' AND attempt_sequence=o.attempt_sequence;
+ IF o.id IS NULL OR o.state='recovered' OR at_time IS NULL OR (p_input->>'firstRecordedAt')::timestamptz IS NULL OR
+  btrim(COALESCE(p_input->>'evidenceKey',''))='' OR btrim(COALESCE(p_input->>'externalRef',''))='' OR
+  (p_input->>'amountMinor')::bigint IS DISTINCT FROM i.amount_minor OR p_input->>'currency' IS DISTINCT FROM i.currency_code OR
+  (o.state='prepared' AND prep.receipt_key IS DISTINCT FROM p_input->>'prepareKey') THEN
+  RAISE EXCEPTION 'subscription_retry_positive_evidence_required' USING ERRCODE='22023'; END IF;
+ PERFORM public.payment_truth_ingest_event(p_input->>'evidenceKey',
+  encode(sha256(convert_to(jsonb_build_object('operationId',p_operation_id,'input',p_input)::text,'UTF8')),'hex'),
+  p_key,i.id,'captured',i.amount_minor,i.currency_code,at_time,NULL,NULL,
+  p_input||jsonb_build_object('renewalOperationId',p_operation_id,'operationFingerprint',o.operation_fingerprint),
+  NULL,NULL,p_input->>'template');
+ UPDATE public.subscription_renewal_terms SET next_cycle_number=GREATEST(next_cycle_number,
+  (SELECT cycle_number+1 FROM public.subscription_renewal_operations WHERE id=p_operation_id)),updated_at=at_time WHERE subscription_id=o.subscription_id;
+ -- A waiting-state refusal released this obligation's stock. Paid lines must
+ -- re-enter the existing ATP hard holds; consumed rows are not counted there.
+ -- Serialize with the native allocator using its deterministic stock-row locks.
+ IF o.state='waiting' THEN
+  PERFORM stock.sku FROM public.fulfillment_stock_current stock
+   JOIN public.fulfillment_inventory_reservations reservation ON reservation.source_key=stock.source_key
+   JOIN public.fulfillment_inventory_reservation_lines line ON line.reservation_id=reservation.id AND line.sku=stock.sku
+   WHERE reservation.renewal_operation_id=p_operation_id AND reservation.status='released'
+   ORDER BY stock.sku FOR UPDATE OF stock;
+ END IF;
+ UPDATE public.fulfillment_inventory_reservations
+  SET status=CASE WHEN status='released' THEN 'committed' ELSE 'consumed' END,
+   expires_at=CASE WHEN status='released' THEN NULL ELSE expires_at END,terminal_reason=NULL,updated_at=at_time
+  WHERE renewal_operation_id=p_operation_id AND
+   (status='committed' OR (o.state='waiting' AND status='released'));
+ IF o.case_id IS NOT NULL THEN PERFORM public.dunning_lifecycle_record_recovery(o.case_id,at_time,p_input->>'template'); END IF;
+ UPDATE public.subscription_retry_obligations SET state='recovered',next_retry_at=NULL,updated_at=at_time WHERE id=o.id RETURNING * INTO o;
+ result:=to_jsonb(o);
+ INSERT INTO public.subscription_retry_receipts(obligation_id,receipt_key,kind,attempt_sequence,input,result)
+ VALUES(o.id,p_key,'recovery',o.attempt_sequence,p_input,result);
+ RETURN result;
+END;
+$$;

package/sql/20261024184600_subscription_retry_candidate_payment_filter.sql

@@ -0,0 +1,22 @@
+-- Donor: supabase/migrations/20261009110000_subscription_dunning_active_repair.sql
+-- (due-reader paid exclusion); 20260912164500_retry_admission_observed_provider_success.sql.
+-- Native waiting-obligation selection translates managed unpaid-cycle/intent admission.
+-- Native CTL-2 Y: omit paid cycles and settled intents before retry LIMIT so
+-- stale waiting obligations cannot starve genuinely due declines.
+-- Requires the native prefix through CTL-2 X (20261024184500). This read-only body
+-- replacement retains the exact arguments/defaults, STABLE volatility, invoker
+-- rights, search_path, ordering, limit clamp and effective ACLs. No close route,
+-- state rewrite, grant, seed, subscription pause or driver activation is added.
+-- Native only; no managed twin is installed. Keep this forward on code rollback.
+CREATE OR REPLACE FUNCTION public.subscription_retry_candidates(p_limit integer DEFAULT 50,p_now timestamptz DEFAULT now())
+RETURNS jsonb LANGUAGE sql STABLE SET search_path = pg_catalog AS $$
+ SELECT COALESCE(jsonb_agg(to_jsonb(c)), '[]'::jsonb) FROM (
+  SELECT o.* FROM public.subscription_retry_obligations o JOIN public.subscriptions s ON s.id=o.subscription_id
+  WHERE s.status='active' AND o.state='waiting' AND o.next_retry_at<=p_now
+   AND EXISTS(SELECT 1 FROM public.subscription_cycles cycle
+    WHERE cycle.id=o.cycle_id AND cycle.status<>'paid')
+   AND EXISTS(SELECT 1 FROM public.commerce_settlement_intents intent
+    WHERE intent.id=o.settlement_intent_id AND intent.status<>'settled')
+  ORDER BY o.next_retry_at,o.id LIMIT LEAST(GREATEST(p_limit,1),500)
+ ) c;
+$$;