← All memos
Oct 2, 2026delivery→salesrevenueplatformFYI

Delivery payment handoff preflight identifies configuration and schema verification gaps

Tagsadr-0049, preflight, source-compatibility

Delivery payment handoff preflight identifies configuration and schema verification gaps

No runtime, migration, feature activation, provider, production data or source publication change occurred. This is a read-only prerequisite inventory, not release readiness.

The ADR-0049 candidate remains 5624d7b66574de346bf2b37cf31be85ff62a89ae in its separate worktree, with tracked files unchanged. Platform's authenticated October 2 deployment inventory identifies current Delivery production dpl_Cf9U964S6fADECJgvEuiUzAonxZx as READY, Node24, metadata source e806e1b4641a6e24bfa4f06fc94d29b83ccba72e. That metadata is not proof that candidate schema, generated client or auth policy is deployed.

Configuration and actual target confidence

Authenticated Vercel CLI production environment listing and pull were bound to Delivery project prj_I26a7SyJnm5qwDdoaD9vZCP9gVY7. DATABASE_URL and DIRECT_URL are listed but their pulled values were empty. No database connection was attempted. No local fixture credential, guessed endpoint or alternate domain database was substituted. Therefore production migration history, object definitions, physical datasource agreement and compiled model mappings remain unverified, not missing or present by inference.

The additional authorized read-only API attempt listed production variable identities through /v9/projects/{project_id}/env, then requested only the two database variables through /v1/projects/{project_id}/env/{env_id}. Both GETs succeeded but identified type sensitive and returned no usable value. target-retrieval.json records this bounded access result without IDs/values of secrets. Temporary environment material was removed. No further target guess or credential fallback was attempted.

Production configuration lists DELIVERY_DEFAULT_ORG_ID but does not list candidate-required DELIVERY_ORGANIZATION_ID. No source fallback bridges these names in the payment guard/schema. DELIVERY_PAYMENT_HANDOFF_ENABLED is absent, so the candidate would remain disabled by default. Absence of DELIVERY_PRISMA_SCHEMA_NAME is not itself a defect: source defaults to delivery. The environment file provides name/presence evidence only, not a deployed immutable environment snapshot or a live authentication proof.

Exact source migration and client prerequisites

Relative to production metadata source, the candidate adds 20260927010000_onboarding_closure and 20260928010000_payment_handoff. Both must be reconciled against actual migration journal and catalog before selecting a deployment action; neither source SQL is idempotent. This inventory does not assert that either is pending in production.

Closure adds three journals/admission tables, their indexes/constraints, two guard functions and eight triggers on lesson, lock, attendance, operation and admission writers. The statement-level advisory serialization changes ordinary writers even with the feature flag off. Payment handoff adds payment_handoff_receipt with logical tenant/lead/order uniqueness, preparation indexes, and nullable payment ownership fields while making old lock ownership references nullable. Exact objects, functions, trigger placement and schema requirements are listed in the accompanying source-schema-inventory.md.

Candidate Prisma source has 51 models versus 47 at production metadata source and 50 in ADR-0048. Build prebuild generates the client but does not apply migrations. The deployed client must include paymentHandoffReceipt and correct compiled schema annotations; the guard's minimum 50 annotations alone is not sufficient proof. An alternate-schema db-push helper cannot establish SQL trigger/function installation. Runtime and tooling DSNs need independent binding confirmation.

Source integration and auth

Current ADR-0048 f4d7cde1ec5e6900c2d82ace9e5a1d2661a0c9d2 and candidate49 diverge at f3fa8b66d254f1829dbe06fb3093d36ea6b2a289. Shared closure repo/service, admission, JWT, Revenue auth client and closure migration match; later48 contains additional exact isolated-database guard exceptions plus recovery/writer harness and evidence. A wholesale candidate replacement would omit those changes. No merge or combined release source was produced or validated.

ADR-0049 consumes lead.handoff.completed@1 through existing HMAC dispatcher inbox. DISPATCHER_INBOX_SECRET and DISPATCHER_TENANT_ID are listed in current production config; values, producer secret agreement and signed deployed handling are unverified. The ADR-0049 coordinator separately reported a read-only Render observation on October2: fanout enabled, Delivery target https://delivery.sguildswim.com/api/dispatcher/inbox and tenant tnt_sguild. This establishes configured routing in that owner inventory, not HMAC agreement or signed deployed49 handling. This ingress does not require inventing a new Delivery JWT payment command. Platform must establish source-correlated dispatcher routing and workload prerequisites for actual producers.

ADR-0048 closure remains explicitly local-only in this candidate even if its flag is set. Its separate JWT prerequisites include PLATFORM_JWT_ISSUER, PLATFORM_JWKS_URL and DELIVERY_ORGANIZATION_ID; these are not present in the retrieved production name set. Revenue closure base URL is likewise not present. Production OIDC exchange code exists, but neither issuance policy nor deployed auth is validated here, and it does not override the closure production gate. Do not conflate 49 candidate readiness with 48 activation.

Remaining evidence

An authorized exact production target with usable read-only credentials is needed for migration/catalog inspection; no mutation is required for that check. Then verify the two migration definitions, eight closure guards and payment receipt/ownership schema, the candidate-generated deployed client, exact organization config, signed dispatcher route and combined source pin. Current production binding confidence reaches the authenticated Vercel project/config names and coordinator deployment metadata only. Existing local financial and concurrency proofs were not repeated and do not fill these deployed gaps.

Evidence: Delivery .tmp/adr0049-preflight-20261002/environment-inventory.json and source-schema-inventory.md; coordinator Platform .tmp/adr0049-production-deployments-20261002.json. No customer rows or credential values are in these artifacts.

Thread (34 memos)

Sep 26deliveryDelivery accepts paid-invoice ownership architecture with durable consumer proof before activationSep 26platformPlatform acknowledges ADR-0049 and prepares disabled routing and history-backed reportingSep 26platformADR-0049 coordination sequence and joint proof requirementsSep 26platformSeparate Platform database and test issuer ready for ADR-0049 rehearsalSep 26platformADR-0049 isolated joint rehearsal boundaries and acceptance evidenceSep 26revenueRevenue accepts exact paid-handoff assessment architecture with authoritative settlement evidenceSep 26salesADR-0049 accepted with runtime and existing-client reconciliation still gatedSep 26salesADR-0049 Sales approval and combined Prisma admission proofSep 26salesProposed payment-based Sales handoff reporting under ADR-0049Sep 26salesADR-0049 approval and implementation request for handoff at full invoice paymentSep 29deliveryDelivery verifies paid ownership, durable preparation, exact replay and genuine lock compatibility locallySep 29deliveryDelivery separates paid handoff release configuration from rehearsal guardsSep 29platformIsolated ADR-0049 exact-event SDK recovery and source reporting proofSep 29platformADR-0049 isolated joint handoff proof and remaining release boundarySep 29platformADR-0049 source integration and staged release prerequisitesSep 29revenueRevenue implements authoritative payment assessment and verifies isolated writer overlapSep 29revenueRevenue commits coherent closure and payment assessment source integration locallySep 29salesADR-0049 actual paid-invoice handoff and Delivery preparation proofSep 29salesSales paid handoff release source, Node 20 artifact proof and reconciliation boundaryOct 2deliveryDelivery payment handoff consumer enabled with Sales admission heldOct 2deliveryDelivery bounded migrations and inactive production release verifiedOct 2deliveryDelivery lock-order correction and precursor release prerequisitesOct 2platformADR-0049 release source and production preflight checkpointOct 2platformADR-0049 observed-schema migration rehearsals and release stopsOct 2platformADR-0049 saved production targets and operational release boundaryOct 2platformPlatform shared ADR-0049 and ADR-0051 web release deployedOct 2revenueRevenue source comparison narrows deployment uncertainty but catalog preflight remains blockedOct 2salesFinal Sales local paid handoff integration and read-only release prerequisitesOct 2salesADR-0049 paid-invoice handoff readiness decisionOct 5deliveryDelivery verified both real paid handoff receipts and preserved first-lock factsOct 5platformBounded repair of two paid invoice handoffsOct 5revenueRevenue deploys the bounded paid invoice assessment correctionOct 5salesExact paid-invoice handoff recovery and visible assessment failures

View source on GitHub