# ARR validated daily ingestion

This package is the authoritative validate-before-write boundary for ARR2.

```text
committed source/output objects
  -> DeliveryEnvelope 1.0
  -> DeliveryValidator (identity + strict v3 reconciliation + validate_daily.py)
  -> PostgresIngestionRepository (one atomic transaction)
  -> current Finance facts + privacy-minimized outbox
```

`JobRegistration` records source/processor/rule/attempt identity before processing. Controlled processor failures use a
complete failed delivery and retain auditable outcomes without changing the current Finance version. Timeouts,
process-start errors, malformed artifacts or pre-commit validation errors use explicit lifecycle failure state.

Only recognized transient PostgreSQL SQLSTATEs reopen the full transaction, at most four attempts. Business, Schema and
identity errors are never retried. Exact delivery replay is idempotent; changed bytes under the same ID conflict.

Migrations 009/010 and direct-submission modules remain historical compatibility surfaces, but ARR2 uses the generic
artifact-delivery tables with their existing `artifact_callback` default and does not expose an MCP gateway.
