# Reservation recovery and reconciliation

**Purpose:** Operational response when drift, orphans, or incidents occur.  
**Detection:** [`reservation-drift-detection.md`](reservation-drift-detection.md). **Expiration:** [`reservation-expiration-safety.md`](reservation-expiration-safety.md).

---

## Part 7 — Recovery and reconciliation

### Reconciliation procedures

1. **Freeze** (optional) new reservations for affected slice if **A0/A1** ([`reservation-invariants.md`](reservation-invariants.md)).
2. **Replay** reservation ledger + stock ledger to golden `reserved` / `on_hand` / `available` in staging copy of data.
3. **Diff** against production projection; if match after controlled rebuild, swap or row-level repair under change ticket.
4. **Post** activity log entry + customer comms if customer-visible ATP was wrong.

### Stale reservation cleanup

- **Automated:** expiration sweep path only — no ad-hoc SQL `UPDATE reserved`.
- **Manual:** requires **ticket + approver**; implementation posts **`release`/`expire`** ledger entries via admin tool, not silent projection edits.

### Orphan repair policies

| Orphan class | Default policy |
|--------------|----------------|
| Missing source entity | Auto-`release` with reason `orphan_source_deleted` after N days in quarantine |
| Over-hold vs demand | `release` excess with reason `reconcile_demand` |

### Corruption escalation procedures

- **A0/A1:** incident commander; block pick until cleared if pick uses reservations.
- **Recurring A2:** engineering owner + capacity for hardening sweeps.

---

## Part 8 — Future allocation compatibility

| Future capability | Expectation |
|-------------------|-------------|
| **Order fulfillment** | Reservation per line; consume/`stock_out` tied to shipment confirm `correlation_id`. |
| **Pick-pack-ship** | Multiple partial `consume` rows keyed by pick task id. |
| **Distributed warehouse allocation** | Same invariants per **node**; central ledger remains **source of truth**; edge caches are TTL’d and subordinate. |
| **Wave picking** | Batch `correlation_id`; lock order includes wave id only if it does not violate `(tenant, wh, item)` global order — **document** extended ordering if introduced. |
| **Manufacturing allocation** | `source_type` distinct from sales; consume links to material issue movement family (future). |

**Compatibility rule:** new flows **must** extend ledger entry types and locking — they **must not** bypass projection locks or R1.