Guarded unpaid cancellation and exact terminal evidence for onboarding Lost closure
Why
The operator approved a Lost workflow that pauses outreach immediately and retains Closure pending until linked unpaid invoices and reservations are authoritatively resolved. Paid or locked items require separate resolution. Sales is implementing the journal and UI locally; automatic cancellation and deployment remain gated.
Source evidence and asks
Revenue modules/credit-reservation/service.release-api.ts reads state before its transaction and later updates by ID; existing policy permits locked releases and does not impose the unpaid/pending condition required here. Please provide an atomic guarded command that rejects payment, funding, lock and consumption races without debit reversal or forfeiture, plus durable idempotent outcomes.
Revenue modules/order-external/service.ts rejects Paid but does not impose a zero-amount-paid guard. modules/order-cancel/index.ts writes canonical status by ID. Square invoice-version protection is useful but does not alone protect canonical payment writeback. Please enforce zero money, authenticated organization/resource ownership and race-safe provider/canonical completion, with recoverable evidence if only one side commits.
Delivery modules/lesson-hold/repo.ts locks local rows and checks hold version, but requested/held cancellation uses its own mirror without authoritative Revenue financial eligibility. Please propose the guarded composition so cancellation cannot clear a newly funded/locked lesson. Completed/consumed records must be preserved.
Revenue exact reservation and sales-ordering reads currently authorize Delivery rather than Sales in lib/auth/platform-jwt.ts. Revenue and Platform: provide a least-privilege Sales-authorized exact inspection capability for selected organization/person/order/reservation IDs, including terminal, absent, paid amount, lifecycle and funding states. Person-wide open/completed lists cannot prove an absent invoice was cancelled.
These findings are from local source inspection. Owners should confirm deployed behavior and reply with contract/version, scope, implementation commitments and test evidence. This memo requests owner work; Sales will not modify producer repositories or bypass policy through database writes.
Approval and activation
Please respond on this thread with acknowledges: [ADR-0048], objections or concrete amendments. The ADR proposes the outcome guarantees, not an invented wire protocol. Production remains disabled until the owners agree the protocol and concurrency evidence, and Sales verifies end-to-end unpaid cancellation, stable-key replay, crash recovery and payment/lock races. In-flight Sales booking/send admission also needs serialization evidence before activation.
Analytics questions
- Which leads await cleanup? Open Sales Task rows with type onboarding_closure identify them.
- Which obligation blocks closure? Task metadata preserves item status and error.
- Who requested closure and what completed? Request actor/reason and append-only audit/step evidence answer this without changing financial history.