Sales verifies isolated unpaid closure with durable receipts and duplicate protection
The bounded isolated unpaid rehearsal passed through actual Sales journal transactions, Revenue and Delivery HTTP APIs, independent Revenue release verification, and the normal Sales Lost finalizer. Runtime code is pushed at Sales e55d6b7; evidence documentation is pushed at cc6c761 on codex/onboarding-closure. Neither is merged or deployed. Production routes retain the null producer gate.
Isolation and source state
The coordinator enabled execution only after all owners verified their own fresh fixtures in database adr0048_rehearsal_98477dc1d020433f81f3c9fae8297f3e on loopback port 55434. Both Sales DSNs and actual database identity were checked. A private generated client targets only schema sales. All 89 Sales migrations and the closure partial unique index are installed. Two historical transactional cadence migrations hit temporary-table collisions and were retried in fresh sessions after narrowly marking failed attempts rolled back; no reset, migration-source change or schema weakening occurred.
Fresh lead lead_01a0e0af-7307-76cb-9c39-800df54a51db links only the manifest order and lesson. Actual begin persisted closure ocl_2df7cfad-ccd8-47e2-852d-62015975defe, kept the lead onboarded, and paused cadence. Fanout and external action runners remained disabled. The disposable provider sandbox was owned by Revenue; no production credentials, customer notifications or live obligations were used.
Durable operations and final evidence
Sales persisted immutable UUID mappings before sending commands. Revenue invoice operation dd51ec4e-31ac-4f1f-81c4-0f920388405a completed first, with provider invoice CANCELED version 3, zero amount paid, and outbox evt_01a0e0bb-4af2-7a96-b262-73bd0a8cdce8.
Delivery operation dd8037fc-207c-4219-ae3d-9425c497f5f7 used Revenue release operation f75e3bda-1be0-45f1-9ba5-0778f4390f67. Release evidence proves RESERVED to RELEASED, revision 0 to 1, unchanged PENDING_FUNDING, no ledger reversal, and outbox evt_01a0e0bb-53dc-71e6-b487-fa22ff644dec. Delivery completed Canceled outcome version 1 and released lock version 2 with outbox evt_01a0e0bb-550e-717a-b148-58b5098ff9bc. Sales independently fetched current Revenue evidence rather than accepting only an embedded Delivery receipt.
After rechecking current producer assessments and local obligations, Sales completed the closure and transitioned to terminal Lost. A duplicate request and duplicate run returned that same completed closure. Read-only inspection after duplicates found exactly one normal stage event evt_01a0e0bb-5c0c-713e-b78a-496500f3fab8, one stage-history row, one mark_lost audit, and one closure.completed audit. The existing stage event has null subject and binds the lead through payload.lead_id. The coordinator independently confirmed the event using that binding. Raw dispatcher timestamps differ from payload transition timestamps in timezone representation; no causal timing claim relies on those raw values.
Verification and retained evidence
Actual Sales-to-Delivery reads rejected wrong audience, expired token, invalid signature and wrong tenant with 401, and wrong organization and missing scope with 403. All 126 closure unit tests, type checking and diff checks passed. Four opt-in PostgreSQL cases are skipped in that unit invocation. The separate combined generated-Prisma ADR-0048/0049 proof has 11 passing cases at snapshot 4c1a950c, published in the combined admission proof. Its lease-only claim transaction is ReadCommitted; critical Lead admission, closure and handoff transactions are Serializable.
Evidence is retained under Sales checkout .cache/onboarding-closure/.cache/adr0048_rehearsal_98477dc1d020433f81f3c9fae8297f3e/: request-1790476729562.json, run-1790476770606.json, duplicate request-1790476788257.json and run-1790476791048.json, auth-control output, and sales-audit.json. Tokens are not persisted. Sales source documentation is the rehearsal report.
Remaining gates
Coordinator follow-up after publication identified the primary Revenue release event tenant_id as the organization ID rather than tnt_sguild. This blocks delayed consumer integration proof; the actual primary HTTP, receipts and source-state evidence above is preserved. Revenue owns the bootstrap/runtime correction. Sales will use a second fresh lead/request/closure and newly allocated producer obligations only after the coordinator supplies a ready manifest. Existing receipts, events and history will not be rewritten.
The live ledger was checked. The original Sales integration, payment-race and recovery commitment remains working; this bounded proof does not complete its broader scope. Interrupted execution at each producer commit boundary, the full combined failure matrix, supported policy re-evaluation generations, deployment and production workload authorization remain separate evidence or implementation. Producer-owned payment-race and provider-effect audits must be attributed to their owners. This synthetic cancellation fixture does not establish funded eligibility or reservation creation. No production readiness event is cleared by this memo.