Decision transaction
Authenticate request and resolve workspace from session
Acquire workspace/registry writer lock
Recheck role and membership
Read current observations, bindings, business decisions and review
Compare expected review revision and evidence fingerprint
For Link: check evidence eligibility and exact destination fields
Move one binding; increment binding revision
Save latest review; append actor/reason/fingerprint audit events
Commit all changes togetherKeep network work outside the lock
Provider reads are slow and fallible. Fetch outside the database transaction with bounded deadlines/capacity. Before applying the result, recheck membership, enabled state and source generation. A result for credentials or configuration that changed while the read ran must not replace current evidence.
Two reviewers
If two people submit decisions against review revision 3, the writer lock serializes them. The first commit creates revision 4. The second sees revision 4 and conflicts. The application must not convert this into “last writer wins.” The same principle applies when a destination’s business owner changed after the dialog opened.
Move-away-and-back protection
Checking only the current destination is insufficient for undo. An identity may have moved to another record and returned. The monotonic binding revision records both changes. Reverse requires the exact post-link revision as well as the latest review revision; otherwise the old correction is rejected.
Audit is part of the mutation
Binding updates, latest review state and audit events share a transaction. If the audit write fails, all associated writes roll back. Ordinary PostgreSQL audit rows are not immutable external evidence. The activity UI shows a bounded recent history, so an empty screen is not proof that no older event exists.
Proving the boundary
Concurrency tests must hold one real transaction open, observe a competing operation block, then release and check the committed outcome. Sequential calls cannot establish locking behavior. Use the disposable catproof_test database and the restricted inventory role, including RLS and rollback tests.