Durable provider success survives a real process kill

Revenue verified one additional boundary using the pinned ADR-0048 source: provider cancellation committed in the operation journal, then the worker process was killed before the canonical transaction began. A new process recovered the same operation and fingerprint. This proof uses a deterministic local fake provider; every attempted HTTP request is intercepted and unexpected requests are rejected. It does not call Square or any other external service.

The fresh database is adr0048_crash_1c5d04e98b1542b885973538a7b35ca3, schema revenue_crash_test. The separate copied runtime owns its dependencies and generated 48-model client. Both URLs, compiled schema and actual connected database are checked. Seven closure row guards and fourteen statement serializers are installed. The existing native PostgreSQL cluster, ADR-0048 historical databases and ADR-0049 runtime remain intact. No test process remains running.

Observed boundary and recovery

• Operation 142adfa2-856b-46ac-b239-c1189b069892, fingerprint 8c377b7535bfedffd954360bf67379368bccc151c9044f16cb6fe8b55cd2c221.
• Worker PID 24992 was terminated with SIGKILL after its real transaction returned. The barrier only suspended the test worker continuation; it did not fabricate a transaction result or journal row.
• An independent process read durable canonical_pending, provider cancelled, Order OPEN with zero paid, no receipt and zero outbox events.
• Recovery PID 25096 completed the same operation and repeated it. The Order became CANCELED, with one actual canonical order.updated event, evt_01a0ef21-1f6e-7a6c-ae41-f6dae6988352, tenant tnt_sguild.
• The receipt references that exact event ID. Duplicate receipt comparison is semantic because PostgreSQL JSONB may reorder keys. Stored provider evidence equals the crash-barrier evidence. Ledger count remains zero.
• The durable fake-provider invocation log contains one GET and one POST before the kill. Recovery and duplicate execution made zero additional provider calls.

Exact process and source proof includes actual exit signals, distinct process IDs, source hashes, pending rows and final receipt/event evidence. The five source hashes were independently compared with the pinned copy by the coordinator.

Setup provenance and limits

The first harness launch lacked the TypeScript loader and stopped before database seeding. A later seed completed its database rows but Windows rejected fsync on a read-only file descriptor while finalizing the fixture manifest. The descriptor was corrected to writable. Before resuming metadata setup, a separate process verified the exact existing Order was untouched, with no operation, fence, event, ledger entry or provider invocation. No rows were cleaned, replaced or reseeded. Preserved setup interruption records that pre-execution state.

This adds process-level evidence at one boundary only. It does not establish kill recovery before provider outcome persistence, lease takeover, every canonical commit boundary, the full consume/release/forfeit/refund/correction/inbox writer matrix, randomized provider races, global-lock throughput or deployed authorization and queued-event tenant cutover. The broader Revenue ADR-0048 commitment remains working. Current combined Revenue regression passed 609 tests across 78 files; that count includes later ADR-0049 work and is not the pinned ADR-0048 source's original 586-test checkpoint. No runtime source commit, merge, deployment or production activation is part of this memo.