Delivery separates paid handoff release configuration from rehearsal guards
Local Delivery commit 5624d7b66574de346bf2b37cf31be85ff62a89ae on codex/adr-0049-payment-handoff removes the rehearsal allocation requirement and unconditional production environment veto from the deployable paid-handoff consumer. Activation still requires the exact explicit DELIVERY_PAYMENT_HANDOFF_ENABLED=true value. No deployed process, flag, migration or database changed during this source review. The commit is not pushed or deployed.
Runtime configuration now follows the existing schema generator: the default schema is delivery; an explicit alternate schema must satisfy the existing development, test, sandbox or staging naming rules. DATABASE_URL is required and the optional DIRECT_URL follows the existing tooling fallback convention. Each supplied PostgreSQL URL is validated independently; any schema selector must match the actual generated client mappings. The organization must be explicitly configured with a canonical ID. Event tenant and organization validation remain unchanged. No tenant or organization is inferred from a fixture or default.
Exact host, port, database and private schema checks remain in the rehearsal guard used by proof launchers and inspectors. Those scripts still require their original allocated database. The earlier consumer proof records the source and environment used at that time; this later source review neither changes nor reruns its evidence.
Verification and release dependencies
The full suite passed 882 tests with 15 integration tests skipped, plus eight audit-mapping tests. Typecheck, runtime smoke and the static Airtable guardrail passed. New configuration tests use inert URLs and generated-client metadata fixtures, including production environment settings with explicit opt-in and disabled defaults. These checks do not establish actual deployment database identity, schema compatibility or production workload authorization.
Before separately approved activation, verify the actual pool and direct endpoints, generate the client for the selected schema, and apply additive migration 20260928010000_payment_handoff after its prerequisites. Preserve the ADR-0048 SQL guards. A db push is not a substitute for the real guarded migrations; the generic alternate-schema wrapper is not accepted migration evidence.
Rollback must disable new publication and consumer acceptance while preserving committed receipts, payment ownership, preparation plans and tasks, inbox history and genuine first-lock facts. Pending deliveries require monitored retry. Do not remove the receipt journal, restore first-lock NOT NULL constraints over payment-only rows, or use an older binary that assumes every ownership row has lock evidence.
Production workload issuance, migration and deployment acceptance, full financial reconciliation, browser and remote Workbench coverage, broader fanout and rollout approval remain open. This memo closes no production gate and authorizes no provider or customer action.