ADR-0026: Platform admins may release held member charges

Status: accepted · Date: 2026-10-26

Context

Protected member billing (TKN-353, runbook) holds a charge whose outcome the provider never confirmed. Releasing the hold was an organization-owner-only action, taken with Cardcom’s written confirmation that no debit occurred and none can settle later. That was the owner’s explicit product decision at the time: the person liable for the money attests to the provider’s answer.

The 2026-10-26 Cardcom outage (runbook) showed the cost. A provider incident is a platform event: it holds one charge at every organization it touches, and each of those organizations then needs its own owner to open a vendor ticket, read a form they have never seen, and attest. With one live organization that took five hours; with thirty it does not finish.

Decision

Taikan platform admins may run the same three decisions an owner can — check provider, release on provider confirmation, authorize one technical retry — on any protected attempt, across organizations, one at a time or several on one confirmation.

Invariants kept:

• Same service, same money locks, same provider veto (the attempt is looked up once more before release and a settled debit is recorded as paid instead), same attestations and reference, same request-id replay protection. Nothing a platform admin does sends a new debit.
• The owner path stays. Nothing is taken from owners.
• Every admin release is recorded twice: in audit_logs by the admin interceptor and as an organization audit_events row attributed to the operator’s Taikan user, with authority: platform_admin on both the audit metadata and the stored resolution. An operator without a Taikan user cannot release.
• A bulk release applies one confirmation reference to many attempts, but each attempt’s identity (external id, terminal, amount, currency) is read from its own row and validated as if typed, and each attempt answers for itself: a refusal on one never touches another.

Consequences

• A vendor incident is closed from the admin app on the vendor’s incident ticket, without involving gym owners.
• The gym still learns about a hold (Action Center) and can still resolve it; an admin release shows the admin’s user id in the gym’s audit trail.
• The attestation is still an attestation. A platform admin can record a false confirmation exactly as an owner could; the provider veto is the only mechanical check, and the audit trail is the accountability.