Delivery accepts corrected fenced scheduling design and selects legacy quarantine

Assignment ADR-0052/delivery/003; coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc, host local; participant 01a0ff07-cd25-7490-9008-a734cad7147e. Delivery accepts the corrected four-policy architecture and the specific changes below. This consolidates and supersedes conflicting design clauses in Delivery's first fenced-bind proposal; historical memos remain unchanged. Full ADR acknowledgment remains withheld until the exact contract drafts below are reviewed. No runtime authorization or other domain's approval is asserted.

Corrections accepted

Delivery accepts Revenue's atomic bind-to-financial protection handoff. A committed bind transfers protection to the exact close's durable financial attempt under common serialization, or retains protection pending current booking verification. There is no unprotected interval permitting release to race charge admission. If Revenue ends protection without collection admission, the old close cannot later collect without revalidation. Genuine incoming payment/refund facts and their proper events remain recordable; conflicting allocation, repointing and lifecycle effects are staged or reconciled, never used to suppress external truth. This supersedes unconditional fence clearing in the earlier proposal.

Evidence carries immutable admission_reservation_revision, current authoritative closureRevision as reservation_revision, and current intent_revision for settlement CAS. Original identity, fingerprint and admission revision never change. Settlement CASes the current intent under serialization rather than demanding equality with an old reservation revision. Coherent evidence must cover related account/Person/Organization/market, order/provider and lesson/window writers. Bind/settle/cancellation share Delivery's Lesson authority; Revenue's invalidating writers, financial admission and obsolete workers cannot bypass its fence.

Ordinary release uses its existing 409 envelope with transient scheduling_bind_pending, which is not permanently cached. ADR-0050 new-child admission that is blocked follows existing immutable current_eligibility_blocked rejection. Already-admitted work retains its journal/head/generation/fence and reports blocked current assessment; historical receipts remain unchanged. Clearing a scheduling blocker does not resurrect a rejected child, authorize a replacement key or prove cancellation noncommit. Scheduling settlement and ADR-0050 proof identities remain separate.

Delivery accepts admission-specific v2 soft-create keys, allocated once and saved before send, with permanent command/receipt/tombstone retention. Protocol metadata and normalized validated snake-case wire identity live in a separately versioned journal. Strict v1 records, original actors, keys and receipts are not rewritten. Shared vectors must settle omitted/null/default fields, notes, offsets and numeric encodings, not only JSON key order. Current JWT/Organization/resource authorization and exact saved identity precede every receipt disclosure; historical success does not rerun eligibility or establish present readiness.

The accepted admission predicate is exact enabled active-Organization sales, owner or admin membership conjunctively with the fresh matching-user Sales app verdict. Admitted commands are service-owned despite later initiating-human revocation. Every individual attempt on each of the four paths uses its own newly audited token. Issuance disablement has the agreed bounded residual JWT window, not instant revocation. No other route authority is added.

Selected legacy boundary

Delivery selects no automated legacy execution or receipt replay through ADR-0052's four policies. Only commands originally admitted with the reviewed v2 wire journal and authority provenance may execute/recover under this protocol. A v1 row, matching selection, newly supplied v2 header or operator assertion is not proof of that admission. Missing/evicted keys and incomplete association remain quarantined. No new bind intent, fingerprint, retention guarantee or permanent noncommit proof is fabricated to upgrade them.

A fully proven original receipt may be retained in a separate reconciliation record linking unchanged command/key/actor/receipt bytes and verified producer identity. That record is historical evidence only, not an admission upgrade or executable journal. It can support owner review of history; it does not authorize a POST, settle an uncertain bind, assert current resource access or unlock new admission. Incomplete legacy wire capture is recorded as incomplete rather than reconstructed as byte proof.

The four proposed endpoints expose no automated legacy receipt-disclosure mode. Therefore remove the earlier promise that legacy success can replay through an unspecified reconciled path. Resource-owner review may separately authorize historical evidence disclosure under an explicitly established access mechanism; this memo claims no existing such interface. If owners later need an automated route, the concrete alternative is a separately proposed receipt-only GET keyed by reconciliation ID, with its own policy, current tenant/Organization/resource checks and no execution branch. That would add a fifth authority boundary and needs separate schema/owner review. Selecting quarantine now keeps that addition outside ADR-0052; its impact is manual resolution of legacy blockers rather than unsafe automatic completion. Owners should affirm this narrower scope, not silently add a legacy mode to v2 POST.

Cutover position

Delivery agrees with Sales' planned attempt of at most four hours, with inventory and preparation beforehand, and maximum 14-calendar-day deprecation from scheduling v2 publication. This is agreement on the release-plan bounds, not a live maintenance authorization. All initiators, recovery senders and obsolete writers must be accounted for; the release record must name the timestamp, owner, affected routes and four-hour checkpoint. At that checkpoint failed checks keep admission/sends paused and require an explicit extension or recovery decision. Four hours does not imply automatic reopening. Historical quarantine may remain after deprecation and cannot be cleared to meet the deadline. Rollback preserves authentication, permanent identities and fences, and cannot restore legacy/unfenced writers.

Exact contract drafts needed for acknowledgment

These are proposed draft deliverables for the coordinator to route to their owners, not implementation commitments authored on their behalf. Delivery has no remaining objection to the corrected fencing, financial truth, revision or ADR-0050 boundaries. The remaining scope choice is owner affirmation of legacy quarantine versus a separately reviewed fifth receipt-read policy; Delivery recommends quarantine. Contract examples must prove delayed bind loses to noncommit settlement, bind/financial admission cannot race release, legitimate incoming payment does not strand settlement CAS, denied replay discloses no receipt, and a rejected ADR-0050 child never revives. Runtime proof remains a later activation gate.

Reviewed owner positions at canonical 22512ec369fba86d22e389534b955a2bac4a1136 and consolidated ADR present at observed canonical HEAD e7d637a9b41e49097baafd5dad6c12780fb8c5ea. Original source pins remain Delivery 75589fa, Revenue 5f10755, Platform audit 8f877ad, audit-derived Sales d31ddf1; no deployed claims are made. Live inbox/ledger refreshed 2026-10-03T00:12:01Z (October 2 America/Chicago); no ADR-0052 implementation commitment completed. Only this memo is drafted locally. No runtime tests, implementation, policy issuance, listeners, mutation, publication or indexer/freshness run occurred; coordinator is sole publisher. Delivery's ADR-0049 release-fix ownership and ADR-0050 fixtures remain separate.