# Runtime outbound owner protection

Runtime owns immutable outbound intents, admission, and completed result receipts.
Integration owns provider dispatch and private command state. Core deletion and
identity transfer read Runtime receipts; they do not read Integration command
history. Shared Contract codecs retain the existing V2 identity bytes.

Resource enqueue and the installed record-deletion lifecycle hook use the existing
record owner fence. Deletion checks all pending or accepted resource intents
before enumerating remote links, covering the first create before any link exists.
Unknown intent states also block. A committed deletion rejects new resource work;
an exact already-terminal enqueue retry remains an idempotent duplicate.

Transfer checks source and target Runtime work before changing authority. Result
commit locks its intent before local record projection, so owner checks use current
`FOR UPDATE NOWAIT` reads to avoid a reverse wait against an already-locked record.
Contention is retryable. The owner-leading intent index is added through existing
schema reconciliation, preserving retained data and rejecting index drift.

A validated `NO_EFFECT` resource result settles definite pre-dispatch refusals
without reading or projecting the source record. It never proves a remote identity.
Timeout, lease expiry, ambiguous delivery and partial success cannot produce that
receipt. Integration persists the result before acknowledging it through Runtime.
After Runtime completion, Integration can finish private bookkeeping using that
exact acknowledgement even if the old link has since been retired or deleted.

Completed transfer replay validates target authority separately for each admitted
connector owner. Different owners and an owner's exact V1/V2 links may coexist;
conflicting identity, inactive authority and mismatched record mirrors still fail.

The directly related HubSpot acceptance journeys are `bi-conv-01`,
`post-convert-contact-storm`, `out-409-recover`, and
`out-409-create-frozen-recover`. Their successful outcomes remain the same. A
mutation racing unfinished outbound work can now return a retryable conflict.
Deterministic TiDB tests cover first-link absence, both race orders, result
completion, no-effect outcomes, multiple owners, rollback and lost-response replay.
Live acceptance and performance qualification are separate from these local tests.