Delivery assembled-design disposition

Assignment ADR-0053/delivery/003, coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc/local, participant 01a0ff07-cd25-7490-9008-a734cad7147e. Owner-authored scratch memo for the coordinator's sole canonical publication. Reviewed PR https://github.com/sguild-admin/coordination/pull/4 at exact head af45908fc13ce698097e6ff6dbde66bbdb37bc4b, Platform004 manifest 2df1abfe3d5cef3e62f0bd1b69107705daa45779978e44c78f13a1a5e3092953, file-map 624da6a1d13c5c324ee53f403a3c3fc48d97f1f77e950cb8a0c59afdbafd6bcf. All 44 mapped artifacts independently match both their SHA256 and exact Git blob bytes at that head. The latest incorporated owner positions are the root-supplied publication 6d4d4e55e96539219e9bede72cf7c94ab2336a6b.

Disposition: Delivery accepts its owned compensation, writeback-correlation, history, identity-read and guard design. Formal acknowledgment of this exact assembled head remains withheld for the genuine missing Sales recovery transport. Parent-version choices below are now concrete owner positions to incorporate, not a hold for unimplemented runtime proof. Once the assembled design carries the transport and explicit normative decisions, Delivery can acknowledge design before implementation. No acknowledges field is present because this exact head cannot transport the evidence its consumer must use.

Accepted owner decisions

Accept the dedicated compensation 1.0 command and separate finalization on the same exact Revenue-to-Delivery POST policy. Atomic compensation consumes protected generation g once and installs compensating g+1, sets Scheduled to Canceled, increments outcome and lock versions once, preserves lesson_details_version and immutable associations, and emits exactly one delivery.lesson-hold.cancelled@1 with the bounded proposed reason and canonical Delivery actor. Revenue's reserved-only writeback independently records credit.released@2 and order.updated@1, their exact IDs and zero ledger/account effect. Exact authenticated finalization alone consumes g+1 and installs retired g+2. Ordinary cancel/refund, generic financial event ingestion, elapsed time and ordinary bind retirement never substitute for these transitions.

Accept immutable authority/writeback/receipt bytes plus the separate mutable current_assessment, its correlated closed inputs, monotonic observation revisions, retained-facts digest, operation eligibility and preserved irreversible sender barrier. A fresh as_of or greater epoch number alone grants nothing. The assessment digest includes observed_at. Original command, key, identity, fingerprint and original bind ReceiptRef remain byte-stable. Current workload authorization precedes all historical disclosures. Completed receipt replay returns the historical bytes even when current assessment denies a new effect. No owner HTTP occurs while holding Delivery business locks.

Accept the exact minimal Platform Person/tenancy verdict. New writes require the exact active original pair and canonical active Person. Historical disclosure and authorized unwind use the originally admitted pair and unambiguous Platform lineage, with separately retained original associations. Merged, archived or paused history is not a new-write grant. Missing or ambiguous lineage fails closed. The read is a coherent bounded snapshot, not a distributed identity commit fence. Mutable role/display pointers follow canonical identity; immutable protocol evidence does not.

Accept the dedicated Sales RSA signer and sign-once durable preparation/descriptor registry, Revenue's locally pinned public trust set and irreversible trust-generation watermark, and the explicit active/unseen versus retained-history rotation/revocation rules. No arbitrary signing route, remote descriptor key discovery, reused workload JWT signer or fifth policy. Sales owns signing secret custody and Revenue owns verifier storage. Concrete deployment-secret locations, key ceremony and drain evidence are implementation gates, not unresolved architecture.

Design amendment 1: Sales needs a separate original-obligation assessment

Failing clauses: contracts/sales-ordering-surface/original-close-recovery.md section describing HTTP 200 original_terminal, and validation/adr0053-ordering-v3/ordering-v3.schema.json $defs/RecoveryResponse. The closed original_terminal variant permits exactly protocol_version, result, identity and original_response. It cannot carry compensation receipt, owner writeback, g+2 finalization or current original-obligation assessment. The separate evidence GET is explicitly Delivery-only. Sales cannot satisfy its prescribed retirement predicate from this envelope, event order or the immutable original_response.

Replacement normative text: "Every successful close-recovery assessment carries a required, closed original_obligation_assessment sibling, correlated to the exact outer recovery identity and the saved original descriptor/admission. It is separately observed mutable evidence. original_response and settlement receipts remain immutable. Revenue produces this sibling from its current serialized original registry, sender barrier and financial facts, plus the exact retained authenticated Delivery receipts for that original obligation. Sales never calls the Delivery-only financial-authority observer, obtains compensation authority, or derives retirement from either financial event. An original terminal response alone does not retire recovery."

Minimal schema choice: adopt Revenue004's closed OriginalObligationAssessment and DeliveryCurrentAssessment definitions, exact candidate SHA256 76023ab1c459c16e894408b89e8d7a4e7bb4cadda9c60fb12e0b2ed8d8238ea4, path C:/Users/jallr/.codex/worktrees/revenue-adr0052/revenue/.tmp/adr0053-revenue004-review/original-obligation-assessment.proposed.schema.json. Its active/pending branch requires retirement_eligible=false and a closed reason; its retired_compensation branch requires retirement_eligible=true, WritebackProof, FinalizationResult, finalization raw-body hash and DeliveryCurrentAssessment. Reuse the existing closed compensation definitions. Completed references must agree across every original identity, digest, receipt ID, generation and writeback ID. Require finalization previous g+1/new g+2, phase retired, completed writeback and an original-obligation terminal verdict under the preserved sender barrier. Schema shape alone does not enforce redundant equality or proof digests. never_admitted retains its independent permanent settlement semantics without fabricated compensation. A normal original success remains active/pending under its own obligations, not presumed compensated.

Delivery producer requirement: accept Revenue004's procedure to obtain a fresh Delivery observation on replay of the exact retained completed finalization command under fresh compensation-scope authentication at the existing POST, without a fifth policy or third operation. Choose a closed JSON envelope, not the proposed base64 header. Proposed finalization response envelope is {protocol_version:"1.0", result_receipt:{http_status, response_body_utf8, response_body_sha256}, current_assessment}. result_receipt is closed; response_body_utf8 is the exact retained valid UTF-8 JSON result string, not reserialized current rows, and hashing its UTF-8 bytes must equal response_body_sha256. Parsing this string must validate the existing FinalizationResult and agree with the referenced immutable proof. Preserve the original stored result bytes and receipt-body hash inside this envelope; the transport wrapper is mutable and excluded from that hash. No additional command or query parameter is introduced. Define the envelope as the proposed compensation 1.0 finalization transport for both first completion and successful replay, leaving the compensation command's original result transport unchanged. Every first/replayed successful finalization carries the current observation, including explicit pending/blocked observation when current evidence is unavailable, rather than modifying the completed result or replaying effects.

Fresh Delivery observation uses Revenue004's closed DeliveryCurrentAssessment: exact Association, CompensationIdentity, AuthorityRef, writeback ID/digest, finalization ID/body hash, monotonic assessment revision, observed protection revision/phase, original_resources_reassigned, contradictory_retained_facts, unresolved_original_work, retained_facts_digest, observed_at and assessment_digest. Delivery authorizes the original history under the current workload and exact original resource reach first, obtains any required identity read outside business locks, then coherently reads its original protection/resource/staged-fact rows under compatible local serialization. Frozen receipt replay and fresh assessment are separate decisions. The observed clock must advance for reassociation, original-source facts and protection changes even where facts remain staged; wall time alone is not revision advancement. Digest all closed observation fields except assessment_digest, including observed_at. A retired_compensation positive requires exact retired g+2, original_resources_reassigned=false, no contradictory facts and no unresolved original work. Foreign associations are nondisclosing; known authorized history with a nonpositive observation retains immutable receipt truth and remains pending for Sales retirement.

For uncertainty before the observation can be constructed, wrap the result receipt with a closed observation-unavailable variant carrying assessment_version, exact saved identity, observed_at and a closed reason, with no positive proof. Platform005 must assemble that explicit negative union, body byte limits and duplicate-safe bounded JSON transport. Bound response_body_utf8 to 32768 UTF-8 bytes and the whole envelope to 65536 UTF-8 bytes; reject excess/unknown members and preserve uncertain Sales state. Successful immutable result disclosure does not become a missing result because the fresh assessment is blocked. No coherent observation means no retirement grant. This is new proposed wire grammar requiring producer/consumer agreement, not an already approved PR feature.

Revenue's observer producer receives this fresh observation outside its locks and rechecks its source revision/assessment clock and irreversible barrier under serialization before projecting it into original_terminal.obligation_assessment. Use this exact member name from Revenue004 rather than the earlier generic name. An irreversible retired generation remains evidence about the original obligation; it does not assert current active Person, future slot availability or a fresh replacement admission. Source observation times remain explicit; an old receipt is never relabeled a fresh database snapshot.

Revenue's current assessment is operation-specific. A completed historical operation may be ineligible to execute again without being unsafe to disclose or finally retire the original recovery obligation. Do not require eligibility=finalize after g+2 or treat replay denial as a permission to redo it. The assembled sibling must explicitly express the terminal original-obligation verdict from correlated irreversible proof and current retained facts. An unavailable or contradictory verdict keeps Sales pending/blocked. never_admitted uses its permanent settlement proof and requires no fabricated compensation. A successful original reserved/committed close can carry a not-yet-terminal original obligation; an original success is not proof of compensation. Replacement scheduling always requires separate current admission/resource checks.

Compatibility consequence: revise the proposed ordering 3.0 recovery envelope and proposed compensation 1.0 finalization transport and their semantic vectors before initial acceptance. Existing v2 original responses, v3 original flat responses and historical result bytes remain unchanged. Same scopes, exact paths/query and original identity remain, with no Sales-to-Delivery compensation authority. Producer and consumer must agree on the closed sibling and observation grammar before design acknowledgment. Cover lost finalization response, reassigned/contradictory resources after historical success, missing/stale/foreign/oversize observation and dependency outage. This is a transport/design correction, not a runtime-test gate.

Design amendment 2: settle parent versions and replace conflicting clauses

Delivery's owned scheduling parent version choice is 3.0.0, with compensation sub-spec 1.0.0 and existing original scheduling-command wire 2.0 unchanged. This is a major semantic migration because Canceled/released no longer means the original slot is available while compensating, old terminal/event consumers need an adapter, and an old writer must not bypass the new phase. Calling this parent 2.1.0 conditional leaves consumers' obligations unresolved. Replace the proposed-version header accordingly.

Replace scheduling section 4.1b's statement that failed-close compensation uses ordinary section 4.4 hold-cancel: "An ADR-0053 protected failed-close bind is unwound only by scheduling-bind-compensation 1.0 and its reserved-only owner writeback and distinct finalization. Ordinary hold-cancel does not authorize this protected path. Operational cancellation/release retains the original slot and replacement barrier until exact retired g+2. Unbound soft-hold expiration retains its existing behavior." In section 4.7, scope any inferred financial-settlement implication: "For failed_close_compensation, operational cancellation is not Revenue release/debit/refund truth. Only the dedicated correlated Revenue writeback supplies canonical financial release; its events alone do not retire Delivery compensation protection."

For Platform-owned identity, Delivery supports explicit 2.0.0, consistent with Revenue004, for the changed section 9.5 obligation rather than conditional 1.6.0. The current section expressly requires re-keying historical snapshots; the new immutable-artifact exception changes that normative duty. Replace it with: "Consumers subscribe to person.merged and re-key mutable role/display/cache references to canonical_person_id. They MUST NOT rewrite immutable command bodies, admission descriptors, receipts, event history, proof digests or audit journals. Preserve original IDs in those artifacts and retain separate canonical lineage for historical authorized access. Historical authorization never establishes new-write eligibility." Incorporate the explicit major decision and replacement clause instead of leaving a conditional minor label. Delivery also supports Revenue004's owner choices ordering 3.0, service-auth 1.9 additive and credit-reservation-lock 3.6 additive with strict reason-consumer migration before emission.

These parent decisions preserve ADR-0052's original wire/receipt bytes and fixed deadline 2026-10-17T00:42:57Z; publication of ADR-0053 does not restart that deadline, reopen unsafe legacy paths, or authorize activation. Root must obtain affected consumer positions for the semantic major migrations.

Future implementation and activation gates

Delivery's source remains b53b08832582dea43fba0832be5eea2a480133d3. Migrate every active-protection selector in scheduling-command repo/jobs/source-fact/operational-fact, partial active Lesson/lock uniqueness, OLD and NEW association guards, all indirect resource and SQL writers, coach-slot/replacement predicates and source-fact staging to protected plus compensating. Migrate dispatcher-inbox mirror and onboarding-closure paths so financial events are genuine retained facts and cannot clear compensation protection. Keep ordinary refund helpers out of this handler. Sales must persist the assessment separately from original response, display truthful cancellation with writeback/finalization pending, and clear recovery only from the explicit authoritative original-obligation verdict. Coaching/availability consumers must preserve compensating slot exclusion.

Install the compensation-compatible writer barrier before admission; drain/reject incompatible binaries, workers, cron and direct SQL; never reuse the old epoch-2 marker as sufficient authorization. Immutable journals and exact transition authority are permanent. Rollback disarms new admission/execution and retains fences, history, staged genuine facts and pending obligations. SQL deferred consistency must join exact journal/authority/audit/outbox/receipt, with no self-authorizing marker or receipt circularity.

Later isolated source-pinned real-handler proof must cover races, all OLD/NEW writers and slot blockers, old binary rejection, current evidence contradictions, authorization before replay, every rollback point, full byte replay, finalization uniqueness, response loss and zero unexpected financial effects. Those are implementation/activation gates. They are not reasons to hold architecture once the actual transport and normative amendments above are settled. No Delivery runtime code or database was modified by this review. ADR-0050 listeners and fixtures remain disarmed/preserved; ADR-0049 production remains unchanged.

Independent offline compensation-current validator passed all 13 supplied semantic cases. This is structural/correlation model evidence only, not JWT, signature, concurrency, runtime or production proof. Root alone publishes/indexes canonical artifacts and records formal acknowledgment after correcting and pinning the design.