Delivery approves the exact closure lineage design and composed contract draft

Delivery approves the reviewed ADR-0050 design and exact composed Delivery/Revenue draft interfaces below. No Delivery design objection remains. This acknowledgment approves design, not runtime behavior, migration correctness, deployed authorization, financial/provider effects or activation. The acknowledgment does not itself merge, deploy or enable these interfaces.

Exact reviewed artifacts and published interfaces

The originally reviewed Sales October2 ADR revision ADR-0050-explicit-onboarding-closure-reevaluation-lineage-20261002.draft.md has SHA-256 3016f6153f75f12e0c31926fc016e775a956a196c6ff82d0be976b7c2d8a51e9. Its corrected producer-key paragraph requires Delivery UNIQUE(tenant, lesson) across cancellation kinds, with immutable kind inside each root and no parallel soft-hold/held heads. Revenue retains its own kind-specific canonical resource key.

The original reviewed artifact hashes are retained below as audit history. Publication changes logical schema IDs, references and document metadata without changing validated schema semantics:

The reviewed Delivery source baseline is f4d7cde1ec5e6900c2d82ace9e5a1d2661a0c9d2. This review changes no application code or existing proof history. Draft hashes bind the exact reviewed schema/semantics; publication may adjust document links/frontmatter without silently changing those semantics.

Approved composition

Delivery explicitly settles its old local intent before admitting a child. Persist separately keyed abort and exact old Revenue mapping before external work. Actual admitted Revenue work requires exact NoncommitProof; an absent old release instead requires permanently non-executable never_admitted/key_reserved evidence. A settlement's actual_operation reference alone is not a proof. Unknown or contradictory outcomes keep protection. Aborted admitted children retain their producer heads; no ancestor rewind or sibling resurrection.

Revenue's dedicated original-subject noncommit-proof GET supports both original command versions while preserving old base envelopes. Safe v1 abort reaffirmation creates a NEW timestamped audit fact after serialized safety checks, not invented historical audit data, and cannot touch successor protection. Delivery's exact read projects the complete immutable upstream proof to Sales without granting Revenue release/settlement mutation or broad proof-read authority.

The new release request separates actual predecessor from prior_release_settlement. A true first financial root requires verified empty history; an unused child naming a real financial parent preserves that exact parent. Repeated unused-key ancestry is verified from durable records, not caller JSON or recency. Eventual admission atomically claims every distinct unused ancestor target's successor slot, plus parent uniqueness and head CAS. Alias replay cannot create a second successor after an earlier admitted successor aborts. Missing, cyclic, altered or oversized ancestry fails closed.

Delivery requires release-only receipt/proof schemas, exact old-intent and resource binding, explicit ledger_reversal_created:false and current clear Revenue assessment before local cancellation. An immutable receipt accompanied by reconciliation_required(consumed) does not clear closure. Completed lesson history and Revenue terminal non-resurrection remain protected.

Approved Delivery routes are child POST, versioned operation GET, separately keyed abort POST/GET and exact selected-operation preview GET. Sales' revised ADR explicitly accepts the producer-specific read matrix: Delivery's new wrapper may represent a migrated1.0 root without rewriting it; old Delivery reads reject1.1 with authorized version mismatch. Revenue base reads stay version-specific404, with its dedicated cross-version proof route. Scope/read authority never permits a mutation.

Concrete migration writer barrier

Delivery adopts the concrete design in its draft section9: a migration-role-controlled closure_protocol_control row, required_writer_epoch and admissions_enabled; compatible transaction entry under the existing schema advisory lock480048; transaction-local epoch; and BEFORE STATEMENT guards on every protected existing/new table and outbox path. Covered writers include v1/v1.1 commands and recovery, abort, inbox, completion/outcome correction, binding/expiry/reschedule, repair/backfill and cron. Runtime roles cannot own or bypass protected objects, modify the control row or carry migration credentials. The GUC is a compatibility marker, not a security boundary against arbitrary privileged SQL.

Drain incompatible processes and outstanding upstream work before raising the epoch, retain/quarantine uncertainty, and initialize validated graphs under the shared lock. Admission-disabled compatible recovery may still record genuine incoming lifecycle truth. Rollback disables new admissions without lowering the epoch, dropping history or restoring old binaries. Exact DDL, role privileges, exhaustive writer coverage, drain and concurrent transaction behavior require implementation proof.

Validation and remaining gates

The composed draft resolves all342 references offline. Python checks cover both metaschemas,57 syntax/binding/hash checks and46 Revenue fixtures. Strict AJV2020 with strictTypes enabled compiles96 targets and passes all27 response examples plus6 actual UTF-8 boundary checks; the coordinator independently reports73/73 composed checks. These are schema/example checks, not a database or network rehearsal.

Canonical contract and route-map publication, actual mixed-version CAS and writer barrier enforcement, migration quarantine, all relevant financial/Delivery race winners, restart/crash/provider boundaries, transitive-slot rollback, deployed auth and combined ADR-0049 arbitration remain separate gates. Prior ADR-0048 remains five blocking passes plus a sixth safe outcome with failed blocking assertion. No new fixture, production data, provider action, deployment or activation is authorized by this acknowledgment.

Canonical references

• ADR-0050
• Delivery re-evaluation v1.1.0
• Delivery strict schema
• Delivery examples
• Revenue re-evaluation v1.1.0
• Revenue strict schema

The Delivery publication schema SHA-256 is fe61e8aa7a3e964c11565e0985a36a60e748fd9ec16c48fde75a11341d1c7189; the Revenue publication schema SHA-256 is f5ef0fb4c7bebd4f0a365a077f1f3df6a7c55851ddf772031248f31d6a06fd3e. Original review hashes above remain immutable audit references.