Delivery bounded composed resume proof

Assignment ADR-0050/delivery/003, run ADR-0050/final-composed-resume-001, coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc/local, participant 01a0ff07-cd25-7490-9008-a734cad7147e. Proposed evidence memo for root publication only. This records isolated local proof, not production activation or formal ADR acknowledgment.

Delivery source 8095b96d315405a1b41936c2eb718084085195e0, checkout C:/Users/jallr/.codex/worktrees/adr0050-delivery/delivery, runtime 3492 and observer-only database adr0050_final_05d3105e910543988522a8147a5479a2, schema delivery_final_test_05d3105e910543988522a8147a5479a2. Runtime retained the pinned issuer3581 and Revenue3591, writer epoch 1, with fanout and external actions disabled. Sales resume evidence is SHA256 901c48fe5ae2db30cf74a57d2b265a26ec767062e1edd93cb5b0438aa7de26fc, after the owner recovery fix at 2652c11ea33175dadb9e25f354d8b58cd50c3004. Root allocation remains SHA256 0a5b75e30a2b7d14a9c488ed2d9d18a226e4590f95bea1e065f7962253deddaf.

Independent read-only Delivery proof observed all 57 tables against the exact frozen stopped-run baseline, checked actual journals/rows/outbox, and took another unchanged full snapshot after verification. Exactly seven tables changed: three added child operation/key/lineage rows, three advanced heads, the three original Lesson/lock outcomes, and three dispatcher outbox records. The remaining 50 tables are unchanged. Original three operation/lineage/request rows, all original keys, completed aborts and their settlement evidence are identical to the stopped-run rows. Rejected abort/key cc328bbf-69aa-4978-9dcd-8d8875235b12 remains permanently retained; no reset, deletion, new abort POST or hidden replacement was used.

All three children are completed, terminal generation 1, selecting their own immutable generation-zero root and exact completed predecessor settlement. Lesson outcome versions are exactly 0 to 1, details versions remain 0, and lock versions are exactly 1 to 2. All other Lesson/lock fields either remain identical or are the expected cancellation reason/timestamps/status fields. Three once-only delivery.lesson-hold.cancelled@1 transactional outbox rows match the receipt event IDs, original Lesson/lock/Organization, actor system:delivery, originator sales, reason other, and each child idempotency key. No unaccounted row or field effects were found.

Stored Delivery receipts match the captured real POST and exact same-child GET recovery responses. The full embedded Revenue receipt matches the captured authenticated Revenue operation GET, exact stored mapping request/fingerprint, reservation/account/lesson/Person/Organization/closure, invoice operations, prior never-admitted settlement reference, released revision 1 and no ledger reversal. Revenue database/ledger/provider verification remains Revenue owner's evidence. In the response-loss case, the captured run issued exactly one child POST, then recovered the same completed child/receipt through GET twice; the Sales attempt progressed pending to completed. No second cancellation or outbox effect appeared.

Wrong-Person preview returned a nondisclosing 404. Captured before/after owner observers show all 158 tables unchanged for that denial, including all 57 Delivery tables. The fourth no-Order case has no admitted Delivery root/child or outbox effect; its Lesson and lock are identical to baseline, and its captured Delivery before/after hashes match. Sales-only reconciliation changes do not create Delivery cancellation authority.

Exact machine proof: C:/Users/jallr/.codex/worktrees/adr0050-delivery/delivery/.tmp/adr0050-composed003-postrun/postrun-handoff.json, SHA256 42390d134ce491fb2d4564b7a6733300c9db086f4323d4d7dd1c9f9067469ab4. It retains baseline/postrun/verification snapshot and journal paths/hashes, per-child fingerprints/receipt hashes/events, changed-table inventory, replay and denial checks. Snapshot row hashes are Delivery's length-framed PostgreSQL row-text algorithm; compare hashes within that algorithm, not Sales' different newline framing.

No business call, control change, fixture write or disable was issued during this review. Listener remains preserved pending root disarm. Synthetic workload issuance and a local provider double limit these results to the allocated isolated rehearsal. Root still needs Revenue/Sales owner proof and broader ADR-0050 acceptance disposition. Production activation remains gated on accepted policy/path/schema contracts, compatible writer epoch and migration/drain/privilege/rollback evidence, applicable source-pinned checks and owner signoff. This bounded proof establishes no production financial validation, customer communication, provider deployment or general race/financial coverage. Root is sole publisher/indexer/freshness owner; this scratch memo is not canonical publication.