First closure rehearsal passes synchronous cancellation but exposes Revenue event tenant mismatch
The first isolated actual HTTP run completed Sales closure ocl_2df7cfad-ccd8-47e2-852d-62015975defe. Delivery's independently read source has completed operation dd8037fc-207c-4219-ae3d-9425c497f5f7, lesson les_01a0e0b0-47c8-7d55-a67a-b2e6c8738025 Canceled at outcome version 1, and lock lck_01a0e0b0-47c9-7661-b024-2b5829df63b1 released at version 2. Its actual SDK event is evt_01a0e0bb-550e-717a-b148-58b5098ff9bc. The stored receipt binds Revenue release operation f75e3bda-1be0-45f1-9ba5-0778f4390f67, invoice operation dd51ec4e-31ac-4f1f-81c4-0f920388405a, reservation revision 0 to 1, and no ledger reversal.
Exact replay returned the identical receipt. Same-key changed payload returned 409. A separate completed lesson returned 409 without an intent or history change. A separate soft hold cancelled once and replayed identically without a Revenue receipt or cancellation outbox event. Actual Platform test-signer/JWKS controls rejected expired, invalid-signature, wrong-audience and wrong-tenant tokens with 401, and wrong-organization/missing-scope tokens with 403. This signer is not production workload exchange evidence.
Persisted event mismatch
Revenue exported its exact persisted credit.released@2 event evt_01a0e0bb-53dc-71e6-b487-fa22ff644dec. It carries tenant_id: org_01900000-0000-7000-8000-000000000001. The authenticated operation and Delivery intent use canonical tnt_sguild. Delivery's replay preflight rejected this before any HTTP dispatch. No event, receipt, dedup row, cursor or history was rewritten, and Delivery did not normalize organization into tenant.
The synchronous success therefore does not establish outbox-to-consumer completion. Revenue is correcting new-event tenant configuration under the existing envelope contract, with Platform's conformance review. The corrected proof must use a fresh legitimate source operation and event. Releasing the terminal original reservation again, editing its event, or synthesizing a replacement from the receipt is not accepted evidence.
The coordinator authorized a second generation in the same disposable database, preserving the first generation. Delivery appended fresh lessons and a fresh lock only, reusing the existing canonical identity, Coaching coach and Delivery participant/site/type references. At this memo, generation two is prepared and its authenticated read returns the expected Scheduled/held state; it has not executed cancellation. ADR-0049 runtime work remains paused until this overlapping rehearsal reaches a safe checkpoint.
Runtime and remaining gates
Delivery local commits 1c11c73, 195605c and 1a78cf7 contain the implementation and rehearsal scripts, not deployed or pushed. Actual Prisma testing exposed PostgreSQL void-result deserialization on advisory locks; the return value is now cast to text without changing locking semantics. Full regression after that fix passed 812 tests plus eight audit-mapping tests and typecheck. Earlier isolated repository tests passed 14 cases and raw PostgreSQL guards passed 26 checks.
The dedicated database is adr0048_rehearsal_98477dc1d020433f81f3c9fae8297f3e, with Delivery's private generated client mapped only to delivery_adr0048_test. All eight guards are enabled. Default generated clients and shared schemas are untouched. Fanout and external runners remain off; only the explicitly authorized disposable Revenue sandbox provider is used. No production cancellation, deployment, flag change or customer message occurred.
The implementation/proof commitment remains working pending corrected event proof. Full audit:locks financial reconciliation is not established by the static guardrail: its separate Revenue read capability is absent from the three-selector rehearsal signer. Production issuance, broader writer/provider concurrency coverage and production activation remain independent gates. Pending legacy financial admissions have no automatic expiry or reconciliation; privileged journal rewriting remains unsupported.