Sales proves invoice response loss and hard-kill lease recovery on fresh isolated cases
Sales harness 35bb6c0 passed the two agreed invoice-response-boundary cases using actual Sales journal transactions and Revenue/Delivery HTTP with a local deterministic provider adapter. Application runtime remains e55d6b7. This is not an external Square or production workload proof. Previous fixtures and incident history remain intact, and no application runtime gate changed.
Isolation and results
The fresh dedicated database was adr0048_rehearsal_f79f13aefafe438ca230d7901391770c on loopback port 55434. Both Sales DSNs, actual database identity and private compiled schema were verified: 48 Sales-only models, 89 migrations, zero unresolved migration failures and the closure uniqueness index. Two known transactional migration temporary-table collisions were recovered with reviewed fresh-session retries, without reset or source changes. Each case used fresh lead, person, order, reservation and lesson records from the owning domains. Fanout, external actions and production stayed disabled.
Response-loss closure ocl_8c8e500f-72fb-4f8f-bda1-af51bf28613a used child 20316. Sales verified the persisted operation key/request/fingerprint before forwarding the actual guarded cancellation. It fsynced the completed producer receipt boundary, discarded the response, and remained pending/onboarded with cadence paused, zero Lost events and no Delivery command. Fresh child 28668 recovered invoice operation 30e8bf4e-6c09-4ffb-bc98-17a4ec68655c by exact GET before any Delivery POST. Key, request, fingerprint and receipt remained identical; no second cancel POST occurred. It completed Lost, and duplicate child 27520 made zero transport calls with one stage event, mark-lost audit and completion audit.
Hard-kill closure ocl_f8451af3-7877-4a92-af66-6b5177dcc85e used child 26440. Sales verified its OS command line against the exact harness, case manifest and pause mode, then force-stopped only that child at 22:37:47.014 UTC after the fsynced committed-response boundary. The launcher recorded exit 4294967295. Independent status child 28384 confirmed pending onboarding. Pre-expiry probe child 10604 was rejected with zero transport calls and unchanged lease owner/until. The actual lease expired at 22:39:29.125 UTC; recovery launched 16.068 seconds later, without rewriting any lease, fence or history. Fresh child 25644 recovered invoice operation f4a05a68-9a5b-495d-8727-18794d4cfee7 with identical key/request/fingerprint/receipt, zero cancel POST and one Lost completion. Duplicate child 25852 made no transport calls and retained the same single event/audit outcome.
Independent owner evidence
The coordinator's independent read-only snapshot platform/.tmp/adr0048-recovery-20260929/database-proof-1790721609351.json confirms both cases: Sales Lost, Revenue RELEASED revision 1, Delivery Canceled outcome 1 and released lock 2; two Revenue operations/events, one Delivery operation/event and one Sales stage event per case, all event tenants tnt_sguild.
Revenue's owner verified revenue/.tmp/adr0048-rehearsal/recovery-20260929/source-2026-09-29T22-40-22.398Z.json and provider-invocations.jsonl. Each case has CANCELED zero-money invoice, RELEASED revision 1 with PENDING_FUNDING unchanged, two completed committed operations and exact receipt/outbox IDs, zero ledger or lock debits, one deterministic provider POST overall and none on recovery. This is attributed producer evidence, not a Sales claim about external provider behavior.
Delivery's owner verified delivery/.tmp/adr0048-recovery-20260929/delivery-state-final-both-cases.json, final-receipt-verification.json and delivery-state-final-after-receipt-reads.json. Each case retains one completed cancel_hold and event, Canceled outcome 1/released lock 2 with no debit. Direct Revenue GET semantically equals the embedded receipt and all bindings; Delivery GET remains completed/clear with a stable receipt. Final reads did not add rows/events or rewrite history.
Exact sanitized copies and SHA-256 provenance are retained in Sales docs/evidence/adr0048-recovery-owner-sources.json; Sales source/process/transport evidence is docs/evidence/adr0048-sales-recovery-20260929.json, with its guide at docs/onboarding-closure-recovery-proof.md. All 130 focused tests, standard type checking and explicit proof-script TypeScript checks passed before the actual runs. Coordinator execution/setup gates were closed again after final owner verification, and owners plus the coordinator verified cleanup: no listeners on ports 3480 through 3483; PostgreSQL PID 6096 remains. Revenue PIDs 26356/23972 and Delivery PIDs 24364/27876 are gone. Issuer PID history and the repaired insufficient-scope control are retained, along with all databases, fixtures and evidence.
Remaining work
The original wider commitment stays working. These cases prove invoice-response loss and one actual Sales worker lease-takeover boundary only. Other provider/canonical/receipt/finalizer interruptions, multiple-obligation partial failures and payment/writer/completion/bind races still require their named combined evidence. Production auth/adapter wiring and rollout, supported unlinked soft-hold snapshots and explicit policy re-evaluation remain implementation work. Strict v1 supplies no general predecessor wire representation after abort; Sales must keep unsupported cases pending. A separately reviewed cross-domain proposal is required before adding that lineage flow. This memo clears no production activation gate.
Published evidence
The complete Sales proof package is committed and pushed as e3a0aa8fddb6372f6dc428d884d76dff336623e1 on codex/onboarding-closure. Immutable review links: