ADR-0049 approval and implementation request for handoff at full invoice payment
Why
The operator approved full Delivery ownership when the selected onboarding invoice is fully paid, including existing paid clients. Lesson lock remains financial truth. This requires an explicit earlier ownership signal, not only hiding Sales cards.
What
ADR-0049 proposes Sales-produced lead.handoff.completed@1, transactionally emitted with terminal/handed_off and invoice_paid history. The exact payload is registered for validation; runtime publication defaults disabled. Existing first-lock payloads and ledger timing remain intact. Lead Lifecycle v1.4.0 is the proposed additive release; no existing payload is deprecated.
Sales implements only Sales and coordination artifacts. Other domain work is requested here, not written into sibling application repositories. Reply with acknowledges: [ADR-0049] and declare your own implementation commitments. Architecture acceptance is separate from production readiness.
Asks
Revenue: approve or correct the exact assessment sub-spec, implement the scoped no-cache read, and prove full payment, partial/refunded payment and in-flight ADR-0048 producer operation handling. Current invoice list options do not establish explicit row scope, refund state or cancellation quiescence. No arbitrary list item or historical payment event can substitute for that proof.
Delivery: implement durable event/payload dedup, organization-scoped customer upsert, separate payment-based OrgMarket ownership and first-lock evidence, curated context attachment in either arrival order, and recoverable preparation without a locked reservation. Include repeat and inactive customers, no-booking scheduling work, and later credit.locked/customer.handoff dedup. Return exact customer, ownership and preparation IDs for the isolated proof; HTTP acknowledgment is insufficient.
Platform: register disabled-first producer routing to Delivery and warehouse; confirm revenue.orders.read covers the exact scoped assessment under the existing workload capability or publish the needed least-privilege change. Update handoff reporting to count terminal/handed_off alongside historical successful outcomes without double-counting lead.stage.changed and the specialized event.
ADR-0048 integration: Sales uses the Lead row lock plus serializable revalidation. Closure admission must serialize on the same row and reject transferred terminal Leads. Current/unknown open cancellation or closure task types, open onboarding_operation admission tasks and unresolved rebooking defer handoff. Producers retain durable fences and atomic unpaid predicates. The API's cancellation_pending includes unresolved, rejected-but-unsettled, and recovery operations; neither timeout nor HTTP success proves settlement. Sales will not activate before joint race tests pass.
Sales local implementation evidence
The disabled Sales implementation is complete locally in modules/payment-handoff, with the new outcome, transactional outbox/audit/cleanup, payment-event and repair entry points, paged reconciliation, exact preview/apply tooling and queued-SMS suppression. Raw payment evidence does not confirm payment or stop cadence while the new path is enabled; only the verified transaction does. Existing lock evidence and historical terminal records remain intact.
Validation: 509 tests across 14 focused Sales suites pass in America/Chicago; typecheck, diff checks and event-registry validation pass. The local Postgres rollback proof (modules/payment-handoff/repo.proof.ts) verifies unresolved admission blocking, terminal outcome, invoice-paid history, cleanup, SDK schema validation, transactional handoff event, duplicate receipt and full rollback with zero committed rows. Its Revenue assessment is synthetic; it proves no Revenue or Delivery behavior.
Read-only local preview scanned one correlated active Lead and deferred it as revenue_unavailable, with zero eligible or applied clients. Local cadence drift/readiness checks report an existing missing qualified-cadence enrollment on lead_01900000-0000-7000-8000-000000001011. No shared fixture repair, production preview, transfer or deployment was performed. Sales source changes remain uncommitted in the existing dirty workspace; the additive terminal-vocabulary migration is unapplied.
This completed the initial local implementation commitment only. Subsequent combined Sales proof and architecture acceptance record later evidence and all named domain acknowledgments. The activation/reconciliation commitment remains conditional. Revenue's real assessment, Delivery's consumer/customer/preparation proof, full runtime integration, routing deployment and real cross-domain producer races remain required. No readiness event is cleared by this memo or architecture acceptance.
Analytics questions
When did Sales responsibility end? handed_off_at is the actual transfer transaction time. How long did a paid client wait? Compare Revenue paid_at with handed_off_at. Which Lead, order and market converted without a lock? Join lead_id, order_id, organization_id, platform_market_id and the source-backed invoice_paid stage-history evidence; nullable lesson references do not invent a lock.