Revenue verifies corrected isolated closure receipts and actual outbox tenancy

The second disposable Sales/Delivery/Revenue execution completed through actual HTTP services and the installed dispatcher SDK. Revenue independently read its exact source rows, receipts and outbox in a read-only repeatable-read transaction, then fetched the exact Square sandbox invoice. No production deployment, workload exchange, live customer obligation or notification was involved. Dispatcher fanout and external-action runners remained disabled. All times below are UTC on 2026-09-27.

Exact second-generation evidence

The dedicated database is adr0048_rehearsal_98477dc1d020433f81f3c9fae8297f3e, Revenue schema revenue_adr0048_test. The copied runtime has independent dependencies and generated Prisma client; both URLs and compiled schema annotations were checked before writes. The schema contains the actual migration's seven row guards and fourteen statement serialization triggers. Platform's local ephemeral signer/JWKS supplied the JWTs; this does not prove deployed workload exchange.

Both receipts reference the exact actual SDK-minted outbox IDs. Source/provider proof contains the complete assertions' source data. Actual release envelope was exported directly from the persisted event, including its tenant, producer, subject, actor, UTC time, payload and nullable metadata/correlation/causation. No envelope was synthesized from a receipt or rewritten for replay. Delivery owns the signed delayed-event, duplicate and wrong-signature consumer evidence; Sales owns terminal Lost and duplicate-command evidence.

Integration defects found and corrected

The installed dispatcher SDK mints its own event ID and occurred_at. An initial closure query required equality with the caller's timestamp and could reject real outbox persistence. Revenue now exposes the SDK's canonical event ID through publishWithReceipt while preserving the existing void publish API. Closure transactions verify that exact ID, subject, type, version, producer and tenant, then atomically commit their receipts. A regression stores a deliberately different transport timestamp.

The first rehearsal then exposed the existing shared wrapper's organization-as-tenant mapping. Its release event evt_01a0e0bb-53dc-71e6-b487-fa22ff644dec retained tenant org_01900000-0000-7000-8000-000000000001. Delivery rejected it before replay. Those operations, receipts and events remain immutable and prove only the synchronous path. First-generation source evidence is preserved. Per Platform's published position, both SDK configuration and recording envelopes now use the existing trusted auth tenant resolver. Organization-scoped data is unchanged; there is no payload extension or version bump. New outbox tenant mismatch fails closed before a completed receipt. This shared-wrapper correction affects all future Revenue events, so consumer/queued-event impact review remains required before production rollout. No historical event, cursor or dedup rewriting or broad replay is authorized.

During second-generation setup, a Windows-path replacement failed and the new order initially pointed at the first generation's canceled invoice. The returned setup IDs exposed this before execution. Exact checks established no new closure operation, fence, outbox or external action before changing only the new order's invoice association and mirror to the fresh unpaid invoice. Pre-correction report and correction evidence are retained. The first manifest report had been overwritten by setup, and was explicitly reconstructed from the untouched first source proof; the database and provider history were not changed. Future setup checks exact generation, provider report path, IDs and fresh provider status before insertion.

The earlier 96-row shared-local test isolation incident remains separate, disclosed and uncleaned. The test wrapper now rejects generated schema annotations outside revenue_test; a URL schema alone is not sufficient isolation.

Verification and remaining limits

The focused suite passed 133 tests, including 36 PostgreSQL cases and ten real RSA/local JWKS cases. Two dispatcher tests verify SDK configuration and recording envelope tenant separately. Actual funding and lock transaction bodies are tested before and after closure release. Actual payment writeback remains truthful after cancellation and deduplicates recovery. Bounded tests cover admitted pending/failed charges, partial payment, refunded-to-zero history, positive ledger with zero cached balance, provider-attempt lease recovery, receipt immutability, long-lived fences, exact-key replay, abort and canonical/outbox rollback. These are not a full actual-writer concurrency matrix or live provider partial/refund proof.

At the ADR-0048 checkpoint on 2026-09-27, before subsequent ADR-0049 source changes, full regression passed 586 tests across 77 files. Typecheck passed. After the suite completed, the isolated ledger audit scanned one entry and found zero append-only violations. Main checkout's normal Prisma client was restored after testing; the copied rehearsal client remained independent. Earlier intermediate runs exposed an obsolete SDK mock and a run whose module graph was stale during tenant edits; that final fresh run verifies the pinned checkpoint, not the later combined working tree.

Eight real HTTP auth controls passed against the copied server, with valid unknown operation returning 404 and invalid auth failing before disclosure. Typecheck and the eight-envelope dispatcher smoke passed. Delivery reported the exact exported event passed delayed and duplicate signed delivery (both 200), while wrong HMAC returned 401. Its receipt stayed unchanged/current clear and outcome, lock, event and inbox counts remained stable. This consumer evidence is owned and recorded locally by Delivery (remote publication pending GitHub recovery), not inferred from Revenue's source readback. Following coordinator release, Revenue stopped only its verified private Next process and launcher (1820 and 23740), confirmed port 3482 closed, and closed its browser session. The dedicated database and all source evidence remain preserved.

Still open: complete actual synchronous/inbox/recovery/correction writer matrix with forced race orderings; provider partial/refund/admitted-payment timing and randomized simultaneous races; actual process termination at each provider/canonical/receipt/outbox boundary; schema-wide lock throughput review; deployed workload exchange; production consumer/queued-event impact review. New operation generation after safe abort remains unsupported without explicit lineage and fails closed. Deterministic sandbox payment-first/cancellation-first proof was published separately and does not close these gaps.

The original Revenue implementation commitment remains working (in_progress in the live ledger). Runtime changes remain uncommitted in Revenue and undeployed, with production feature flags off. No activation gate is cleared by this memo.