radar: pass 12 — events 3rd live persist consumer (append-expect/OCC); W4 feature-ladder append->append-once->append-expect

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/abstractions.md

@@ -12,6 +12,11 @@ Anything short → _Watching_ (what's missing) or _Rejected_ (why).
 
 ## Last scan
 
+- **Date:** 2026-06-07 (radar loop, pass 12)
+- **Pass 12:** `events` shipped **transactional booking on persist** (3rd live persist
+  consumer) using `persist/append-expect` (optimistic-concurrency CAS, lock-free capacity
+  safety). W4 ledger now shows a persist feature-ladder append → append-once → append-expect
+  that the hand-rolled fakes can't match. No new candidate; W4 reinforced.
 - **Date:** 2026-06-07 (radar loop, pass 11)
 - **Pass 11 — W4 sharpened with a consumer ledger.** commerce built an **order ledger on
   persist** (2nd live exemplar; uses `persist/append-once` for webhook idempotency) and
@@ -223,19 +228,22 @@ Anything short → _Watching_ (what's missing) or _Rejected_ (why).
 
   | consumer | what | backing | note |
   |---|---|---|---|
-  | content (`store.sx`) | doc op log | **persist/log ✓ live** | append + replay-to-seq |
-  | commerce (`ledger.sx`) | order ledger | **persist/log ✓ live** | uses `persist/append-once` (idempotent, webhook-replay-safe) :40,58 |
+  | content (`store.sx`) | doc op log | **persist/log ✓ live** | plain append + replay-to-seq |
+  | commerce (`ledger.sx`) | order ledger | **persist/log ✓ live** | `persist/append-once` — idempotent, webhook-replay-safe :40,58 |
+  | events (`booking.sx`) | booking roster | **persist/log ✓ live** | `persist/append-expect` — optimistic-concurrency CAS, capacity-safe, lock-free |
   | acl (`audit.sx`) | decision log | in-memory fake (SX) | migrate directly when host adapter lands |
   | mod (`audit.sx`) | decision log | in-memory fake (SX) | migrate directly |
   | identity (`audit.sx`) | grant ledger | in-memory fake (**Erlang**) | `{Seq,Subject,Action}`; needs an **Erlang↔persist bridge** first — author scoped it out until persist lands ("queryable semantics identical") |
 
 - **Two takeaways:** (1) the pattern is **validated across domains** — CRDT doc ops,
-  financial orders, rule decisions, OAuth grants all reduce to the same append-only
-  monotonic-seq stream; (2) migrating to `persist/log` is strictly *better* than the
-  fakes — commerce shows it gives **idempotent append-once** (dedup/replay-safety) for
-  free. This is an **adoption** item (the home already exists), NOT a new extraction —
-  owned by persist/host-persist × each consumer loop. The SX fakes (acl, mod) migrate
-  directly; the Erlang fake (identity) is gated on an Erlang↔persist bridge.
+  financial orders, event bookings, rule decisions, OAuth grants all reduce to the same
+  append-only monotonic-seq stream; (2) migrating to `persist/log` is strictly *better*
+  than the fakes — persist exposes a **feature ladder the fakes don't have**:
+  `append` (content) → `append-once`/idempotency (commerce) → `append-expect`/optimistic-
+  concurrency (events). Every fake would have to reinvent a weaker version of these.
+  This is an **adoption** item (the home already exists), NOT a new extraction — owned by
+  persist/host-persist × each consumer loop. The SX fakes (acl, mod) migrate directly;
+  the Erlang fake (identity) is gated on an Erlang↔persist bridge.
 
 ### W5 · Proof-tree explanation over a logic-program derivation
 - `acl/lib/acl/explain.sx` (reconstructs a canonical proof by goal-directed search over a