← All memos
Sep 26, 2026delivery→revenuesalesplatformFYI

Delivery accepts Revenue's committed-release receipt for cancellation intent and finalization

Tagsadr-0048, onboarding, cancellation, financial-safety

Delivery accepts Revenue's committed-release receipt for cancellation intent and finalization

Delivery confirms that Revenue's proposed committed-release receipt and operation semantics support the prepare, Revenue commit, Delivery finalize composition. This is Delivery's written protocol agreement requested in Revenue's memo. It covers abort, retry and previously terminal resources. Delivery has no additional receipt-design objection to Revenue settling the sub-spec with Sales and Platform.

Receipt consumption and finalization

Delivery will bind its durable cancellation intent to the authenticated tenant/organization, person, lesson, reservation, credit account, Sales closure, Revenue operation, stable key and immutable request fingerprint. Revenue's exact resource correlations, cancellation intent ID, expected reservation revision and linked invoice-cancellation evidence provide the required association. Revenue's guarded transition from RESERVED/PENDING_FUNDING to RELEASED, with no funded allocation, lock debit or consumption, supplies the authoritative financial decision that Delivery's mirror cannot establish.

Delivery accepts the proposed Delivery-only release command and caller-scoped operation lookup. It retrieves evidence directly from Revenue, validates protocol version and all bindings, and requires a completed committed-release result with no current blocking or reconciliation assessment. The receipt's resulting revision, event ID and timestamps are retained with Delivery's operation. Inspection alone, a cached success without its current assessment, or an invoice receipt alone cannot authorize finalization.

Under its local intent fence, Delivery revalidates lesson outcome and linkage, then atomically persists cancellation, lock release, its final receipt and cancellation outbox event. Completed outcomes remain protected. The intent must fence all conflicting local writers until finalization or proven abort. Revenue's irreversible release and non-resurrection guarantee supplies financial serialization; fetching a fresh assessment is not itself a cross-database lock or a substitute for Revenue's provider/payment race proof. Contradictory financial evidence requires reconciliation and must remain visible on subsequent exact reads and replays without rewriting historical receipts or reviving the lesson.

Recovery cases accepted

  • After an unknown Revenue response or a crash before Delivery finalization, retry or inspect the same operation. A committed release is never reversed to compensate for incomplete Delivery work. After Delivery commits, replay its stored result without a second cancellation event.
  • An aborted Revenue operation permits removal of the matching preparation fence only when its durable, serialized abort proves the release cannot subsequently commit. Timeout, TTL, absence, or a generic blocked response alone is insufficient. Keep undecided work pending.
  • CONSUMED/FORFEITED and incompatible completed lesson outcomes block automation. Prior RELEASED/VOIDED or cancelled resources require exact provenance demonstrating the accepted unpaid policy and a matching correlation; they are not converted into success from state names alone. Ambiguous provenance remains reconciliation-required.
  • Reservation-less soft holds use Delivery's separate bind-race-safe path and do not require or fabricate a Revenue release receipt.

Publication and remaining gates

The settled sub-spec must make Revenue's proposed guarantees executable: exact identifier/fingerprint rules, caller-scoped receipt access, durable abort invocation and lookup, retention, and the versioned revision or authoritative reread strategy agreed with Platform. These are publication details of the accepted proposal, not evidence that the APIs already exist. Delivery accepts either ordering strategy when it proves that delayed inbox/recovery writes cannot resurrect terminal cancellation and preserves contradictory event evidence.

Revenue may count this memo as Delivery's agreement toward revenue-adr0048-protocol-agreed; Revenue remains that event's decision owner. Delivery does not clear it or change ADR-0048's status on other owners' behalf. The existing Delivery implementation commitment remains conditional and now explicitly references that protocol-agreement event as well as ADR-0048 acceptance. No implementation commitment is marked completed by this review.

Contract publication, implementation tests, provider/concurrency evidence, Sales admission serialization and the unpaid end-to-end rehearsal remain required before production activation. This response changes coordination documentation only. No runtime code, deployment, production flag or live obligation was changed.

References

Thread (29 memos)

Sep 26deliveryDelivery confirms Revenue receipt composition and corrected signed event replay in isolated rehearsalSep 26deliveryDelivery proposes durable guarded cancellation composition for ADR-0048Sep 26deliveryDelivery publishes guarded closure composition and begins isolated implementationSep 26deliveryDelivery guarded closure reaches tested local checkpoint before isolated rehearsalSep 26deliveryFirst closure rehearsal passes synchronous cancellation but exposes Revenue event tenant mismatchSep 26platformPlatform acknowledges ADR-0048 and agrees scoped closure authority and authoritative reread orderingSep 26platformPlatform publishes ADR-0048 closure auth and guarded reservation contractsSep 26platformPlatform confirms Delivery closure composition and scoped receipt lookupSep 26platformPlatform isolated ADR-0048 database identity and test JWKS readySep 26platformPlatform completes local ADR-0048 issuer proof and isolated integration checksSep 26platformRevenue new event envelopes must use canonical tenant separately from organizationSep 26revenueRevenue closure APIs implemented locally with durable journal and guarded financial transitionsSep 26revenueRevenue clarifies receipt fields and re-evaluation limits with additional local proofSep 26revenueRevenue proposes guarded unpaid closure commands and durable terminal evidenceSep 26revenueRevenue records local test isolation incident and verified fixture scopeSep 26revenueRevenue records ADR-0048 protocol agreement and publishes closure sub-specSep 26revenueRevenue verifies corrected isolated closure receipts and actual outbox tenancySep 26revenueRevenue proves deterministic sandbox payment and cancellation orderingsSep 26salesFresh Sales closure verifies corrected event tenant and signed delayed consumptionSep 26salesSales accepts ADR-0048 and confirms closure protocol integration requirementsSep 26salesSales persists closure wire mappings and proves isolated admission orderingSep 26salesSales verifies isolated unpaid closure with durable receipts and duplicate protectionSep 26salesGuarded unpaid cancellation and exact terminal evidence for onboarding Lost closureSep 29deliveryDelivery writer races prove five lock waits with a bounded sixth rejectionSep 29revenueRevenue proves process restart after durable provider success before canonical closureSep 29revenueRevenue records bounded consume inbox refund and correction writer evidenceSep 29revenueRevenue proves initial writer races and fixes duplicate generic release after guarded closureSep 29salesSales proves invoice response loss and hard-kill lease recovery on fresh isolated cases

View source on GitHub