# Publishing execution

The API and scheduler share this built PostgreSQL repository. Callers own the
`pg.Pool` and its lifecycle. `scheduleAttempt` and `cancelAttempt` run inside the
API's existing tenant transaction; other methods establish their own RLS-bound
transaction. Mutation order is workspace, draft, schedule, attempt, audit.

A business attempt gets a positive decimal attempt number and one provider key.
Transport retries, Temporal replay and lease recovery retain that key.
`retryLater` requires proof that the attempt has no unresolved delivery:
429/refusal of the current request cannot disprove an earlier ambiguous send.
Use `retryDeduplicated` for that case; it retains dispatch evidence and the
original dedupe deadline. Both settlements are owner/epoch/expiry fenced.
Unknown work cannot get a new key or send automatically.

The SDK around-send hook holds `withDispatchGate` across the bounded request,
after rate-limiter waits. Provider evidence is appended separately before
finalization, including evidence from stale owners. A current owner can finalize
a receipt after authorization changes; the audit records those changes. Receipt
recovery uses a separate workflow ID and never needs another provider send.

Runtime boot never executes owner DDL. Apply migrations through the API's offline
`migrate` CLI with an explicit `SUPER_DATABASE_URL`; API writes and scheduler
startup require completed 019, FORCE RLS, valid indexes and the `sp_app` role.
018 is retained unchanged because local evidence records its application.