Platform shared ADR-0049 and ADR-0051 web release deployed

Current release checkpoint

Sales published its readiness decision in e9f24e39dab445c0e4e6f3e1b6dfca783006444d, clearing paid-invoice-handoff-ready, and promoted dpl_9Vff3ftE5dFCUSFmqFNgDg6LsERD from exact current-UI source 091d3c0d41e06bc4a5f476142bdded22d9a2aa49. Saved production flags read back admission true and automatic reconciliation false. Canonical and main aliases and four cron targets were checked. Fresh read-only inventory at 01:35:06Z covered 92 active leads: 88 without invoice correlation and four current correlated candidates; the 86 terminal leads were excluded. Fresh actual Revenue requests at 01:35:35Z to 01:35:40Z again found three scoped unpaid invoices and one intentional scope-unproven rejection for the replacement order without a reservation. The result is zero verified eligible transfers and zero applies. No handoff event, Delivery receipt or reporting conversion for a paid customer was manufactured. Existing isolated positive persistence proofs and live read-only/negative evidence remain distinct. The protected diagnostic was removed after evidence retention.

Worker release completed at 01:31:49Z: Render Auto-Deploy dep-db05l8jm8hqs73cq01i0 is Live on exact 3909dacbdd9070b365f593c6b898c2d8704c0f7b. GitHub CI passed typecheck, lint and all 383 tests in 53 files. Build ran npm ci and Prisma generation without DDL. Both worker children started, the external-actions runner initialized at its existing five-second interval, and Growth polls reported zero loaded rows and zero failures. The fresh 01:29:05Z pre-release read found zero Sales handoff events, backlog and unresolved dead letters, with no cursor mutation. No Render settings, secrets or automatic-deployment policy were changed. The same commit is Ready on Platform Vercel dpl_6z1wxnsS3QdPpVouepXMERHxkjto with canonical, project and main aliases verified. Sales now has authorization for its own readiness publication, saved admission flag, current-UI promotion and fresh eligibility inventory.

At October 3 01:28Z, Delivery payment ingestion is active at source 51cf142c1e24863fafadc09f5b5541ce068246f0, deployment dpl_7d4kFJiqwn5nxo6C35iS2bT7jkDL, promoted at 01:08:11.950Z. Saved and runtime payment flags are true; closure remains false. All 709 uploaded hashes, canonical and main aliases, five cron targets and read-only runtime health were verified. The domain's activation memo was published in 45a037106c10334c84a6abe84364a1766d7cbc64. Its previous final deployment is a compatible flag-off rollback. Delivery's bounded release assignment is complete and explicitly returned to the ADR-0050 owner.

Revenue completed its compatible precursor, real 300-second turnover and two normal migrations once. Final 3912d4ab178ab6cfc3fd798a98e78aaae3d4d5ba was promoted at 00:48:43.259Z as dpl_FTMkY3QDZVzqwQsbjMVV7skBevH6. The two new checksums are 61c9780d41d82a563923195e4ffe8a1e7ea84da634243b7d020013e377cd38bf and e12209df3e5e80555e1d17a6903f9c54b7949bca96bea0285570b66c5ab04683. The journal has 49 completed entries plus two historical rolled-back entries, unchanged history and no unfinished entry. Catalog checks verified the expected tables and 42 payment guards. Assessment is enabled; closure and provider flags remain false.

Actual Sales workload requests exposed a Revenue identity predicate that incorrectly treated every Client.externalRef as a canonical Person identifier. Correction 5417af4cf384ecc91f8a1da7a671a4094993ee05 removes only that predicate and preserves the exact order, reservation, account, Client, Person, organization and market checks. It passed 30 assessment tests and typecheck. The full suite passed 609 of 616; seven unrelated setup timeouts passed on a 46-test retry of the four affected files with unchanged timeouts. The app-only correction is canonical at dpl_DjpzM72TiEFko4BUBXFmjDG19rTJ; all 767 source hashes, aliases, five cron targets and unchanged journal were verified. No migration or data repair accompanied it.

Sales' protected protocol-2 diagnostic then obtained three actual HTTP 200 assessments with matching scope and unpaid invoices. The fourth current replacement order returned intentional HTTP 503 order_scope_unproven: its creditReservationId is null, so exact account and market linkage cannot be established. Revenue reproduced that result in a read-only transaction and confirmed the generic invoice-link creation path permits an order without a reservation. This is verified negative evidence, not an authentication failure or permission to infer scope from a Client account. Sales accepted three unpaid deferrals and one scope-unproven deferral, with zero verified eligible transfers. No provider action, fabricated settlement time, handoff event or customer communication was used as a test. Revenue's bounded assignment is complete and explicitly returned to ADR-0050, with the separate disabled ADR-0048 legacy identity predicate follow-up preserved.

Platform published reviewed source 195a9f4696a3daa61aba45c18abc2310e9b751c6 to main for the existing CI-gated Render integration. CI revealed missing generation environment, one explicit-any lint error in a maintenance script, and an assumption that the private Coordination repo exists beside Platform in GitHub Actions. Follow-up 3909dacbdd9070b365f593c6b898c2d8704c0f7b supplies inert loopback generation URLs, narrows the maintenance error type and provides a pinned accepted canonical test fixture from Coordination 3225646710eb3073a4e8e5e5f8a6fb9f07eeb1cf. Both the fixture and actual local canonical contract passed all four handoff tests. Application, worker, dependency and migration bytes remain identical to reviewed 195a9f4. No CI check was disabled. Render deployment and final Sales activation remain pending at this checkpoint.

Sales staged current UI source 091d3c0d41e06bc4a5f476142bdded22d9a2aa49 as dpl_9Vff3ftE5dFCUSFmqFNgDg6LsERD, Ready with admission true and reconciliation false. All 841 uploaded hashes matched; the build only generated Prisma and built Next, retained four crons and contained no diagnostic route. It is protected, noncanonical and uninvoked. The saved flags and canonical UI were preserved. Sales owns the formal readiness decision after Render is Live. Older staged ESm is stale and must not be promoted.

Earlier checkpoints (superseded where stated)

Latest checkpoint, October 3 at 00:37Z: Delivery final 51cf142c1e24863fafadc09f5b5541ce068246f0 is promoted as dpl_5UUgAwDXv4cAJDetzCnDsL1XFZxM, with both handoff and closure disabled. Revenue's corrected package passed 612 final and 452 precursor tests, both typechecks, dispatcher smoke and isolated ledger audit, plus 19 PostgreSQL compatibility checks. Its owner is authorized to perform the precursor, verified turnover and bounded migration sequence below. Sales has a newer independent UI deployment, dpl_5CN2fyoe7GxuFfkLgC4guQUWQEUo at dc4ff1b121ea7ee199634dca6f41bdd5c1de8bb1; owner comparison confirmed the handoff, closure, onboarding, cadence, Prisma and Platform-client paths are byte-identical to the reviewed release. Both handoff flags are absent and therefore false under the unchanged exact-true checks. The earlier explicit-false deployment remains historical evidence. Render is still unchanged and Sales admission remains off.

At 00:37:56Z, Platform privately compared Render's configured Delivery signing secret to retained local configuration, and Delivery confirmed that same secret was used by its live signed-empty-object check. The correct signature returned 400 for missing envelope identity; an altered signature returned 401. Both paths return before inbox deduplication or domain persistence. This establishes configured transport agreement without inventing an event or receipt. Render's saved Revenue and Delivery destinations use each domain's canonical /api/dispatcher/inbox. Evidence is retained in Platform .tmp/adr0049-render-transport-binding.json and Delivery's activation preparation report. No Render configuration change occurred.

Delivery completed its 300-second turnover interval, followed by fresh transaction and lock observations. Normal Prisma migrate deploy applied the two reviewed migrations once at 00:27:03Z. The final postcheck found 44 finished journal entries, the 42 historical entries unchanged, no pending or failed migration and all 83 catalog assertions passing. Windows Git archive converted the two reviewed SQL files to CRLF. Their actual journal and uploaded-file hashes are 5e015de15d298c4dbcae7fc38a8a8e6ebdf818cd53a03537dbab7cb137b64308 and 74b39da0f972923585aace8445319a1b2b548fdb5dde5dd813c2cd225709cf73. Platform independently verified that CRLF-to-LF conversion reproduces the reviewed bytes exactly, accepted that exception, and authorized promotion of the existing Ready build without rerunning DDL or rewriting SQL or journals. All 709 uploaded hashes matched the archive. Canonical and branch aliases and all five cron hosts target the final deployment; read-only runtime checks passed. Delivery owner publication is a0c057ac6dee81bd2a9e9cd588b3d17e7ad72170. After guard installation, rollback is limited to compatible precursor f820722, not the previous row-first application.

Revenue's accepted runtime correction is 3912d4ab178ab6cfc3fd798a98e78aaae3d4d5ba, with evidence-only successor 47f610c30a4d7fb0aadc2809bbc3fcaa16e7f25f; its schema-independent precursor is 7063c08274fce668044e79c75193fc7449636e77, based exactly on the observed live source. Seven ordinary writer entry points now acquire the shared guard before unguarded writes. The package transparently records an initial test setup command that inspected shared revenue_test and reported it already in sync, with no tests run there and no independent before/after catalog claim. Subsequent tests ran on isolated databases with a post-dotenv target guard. This exception does not constitute production financial validation. The release owner delegated Revenue's app-only precursor, actual old-writer turnover and the exact two normal migrations to its domain owner, with stop-and-inspect on failure and no new admission yet.

Update at 23:53Z: the same source was redeployed as dpl_748XK4Aat4iZKx5Mjt8sJ1zw48hy with only the reviewed Person-resolution flag enabled. It reached Ready, its no-op migration phase found nothing pending, and the canonical alias was verified after promotion at 23:51:04Z. The original disabled deployment below is retained history. Actual Coaching production workload proof subsequently passed malformed-body 400 and wrong-tenant/wrong-organization 403 checks. Platform's issuance audit matched the proof token; before/after identity fact aggregates were unchanged and the fixed proof operation had zero journal rows. ADR-0051 owns its interface-ready milestone and later portal validation.

Platform deployed source 195a9f4696a3daa61aba45c18abc2310e9b751c6 to Vercel deployment dpl_S69zuy3e1aT3iyPm7jWatpF9qVsQ. It reached Ready at 22:12:21Z and was promoted at 22:16:26Z. The authenticated alias API confirms platform.sguildswim.com points to that deployment. This supersedes earlier statements that no Platform application release or migration had run. ADR-0049 activation remains incomplete.

The release combines reviewed ADR-0049 reporting and registry changes, existing ADR-0048 service authentication ancestry, and ADR-0051 Person resolution. Source came from a clean archive of the pinned commit, excluding the dirty primary checkout and dotenv files. Explicit githubCommitSha records the pinned source; CLI-inferred gitCommitSha refers to the enclosing primary checkout and is not the uploaded source attestation. Build installed the committed dependency lock, generated Prisma 7.3.0, and completed the normal production build. Owner local proofs used Prisma 7.8.0; production migration and catalog verification are separately recorded here.

The new Person-resolution endpoint is disabled with PLATFORM_COACH_PERSON_RESOLUTION_ENABLED=false. The explicit Coaching production workload subject is configured. Existing Person minting now uses the reviewed transaction, advisory lock and outbox changes, so the release is not entirely dormant behind that endpoint flag. New admission and broader reconciliation in Sales remain separate gates. No shared main push or Render restart occurred.

Migration and runtime evidence

Fresh preflight at 22:10:39Z found exactly 20261002090000_add_person_resolution_operation pending and no unresolved migration failures. Vercel's normal Prisma migration runner applied it at 22:11:48Z through the verified direct connection to project pfuctqiobbjglpukteei, database postgres, schema platform. The migration has an explicit transaction, two-second lock timeout and 30-second statement timeout.

Read-only postmigration verification at 22:16:02Z found one finished migration record, no failed journal rows, all 14 expected columns, four valid and ready indexes, and zero operation rows. The first verification assertion compared the reviewed LF checksum to deployed CRLF bytes and failed. Exact content comparison after line-ending normalization established identical SQL. The actual journal checksum f738ce8d8b13929e371f2f61de1d1b140f2ee3969bd26651598f907ccf2cd4e7 matches the uploaded file; its LF-normalized checksum is 1f59798a921e2ee6e2d74c439157905be92e60f1866d8ec7c81a9a478215d082. No migration or journal was rewritten or retried to fix the assertion.

Staged and canonical HTTP checks confirmed JWKS 200, disabled Person resolution 503, and missing workload proof rejection 401 on the staged deployment. Actual production workload success and negative authorization checks remain owner release evidence, not implied by these smoke checks. The accepted encrypted manual backup and recovery limits are in the prior target-configuration memo.

Local evidence is retained in Platform under .tmp/adr0049-platform-staged-deployment.json, .tmp/adr0049-platform-staged-build.log, .tmp/adr0049-platform-postmigration.json, .tmp/adr0049-platform-alias-after-promotion.json, and .tmp/adr0049-live-*.headers. The coordinator's resumable routing record is .tmp/adr0049-working-map-20261002.json.

Remaining release boundaries

Sales released f712e191d91bf0b17c8106c1f2012ca910de75fd as dpl_gHGRq2LehsAS6sP6dBuCvQQr4Z92, Ready at 23:53:57Z and subsequently promoted. Its owner verified the actual sales.sguildswim.com alias and production target. The release preserves the independently deployed cadence fix and includes no ADR-0050 code. The exact two reviewed migrations succeeded once; read-only catalog and journal checks found no pending, failed or unknown migrations, a valid open-closure unique index and the expected terminal vocabulary. All 327 task rows remained, with zero open closure rows or duplicates. Both SALES_PAYMENT_HANDOFF_ENABLED and SALES_PAYMENT_HANDOFF_RECONCILIATION_ENABLED are explicitly false in build and runtime overrides. The release-only build omitted prompt installation and repair; no cron, fixture, customer communication, backfill or payment event was invoked. Saved project build settings remained unchanged, and basic live routing returned the expected sign-in redirect. This is inactive deployment evidence, not end-to-end transfer validation or activation approval. The owner report is retained at sales/.cache/payment-handoff-integration/.tmp/adr0049-sales-inactive-production-result.md.

Delivery prepared 817cf5a22649173ea088a0f94fae78f5ddc5273e, changing only two pending migration transaction wrappers from the reviewed runtime. Its and Revenue's guard migrations and application releases have not run under this checkpoint. Their operational compatibility decision remains open.

The shared release owner remains Platform coordinator 01a0e0a8-093e-7d80-b8ef-5997067ae039 on local. Each ADR retains its own milestones. ADR-0051's sole Coaching migration completed and its owner verified the catalog and healthy journal at 23:47Z. Sales then received the next exclusive database window for its inactive release, keeping both payment-handoff flags explicitly false. Consumer readiness still gates event admission. Render remains unchanged until consumer readiness and a fresh retained-event inventory permit that separate shared-worker action. The live paid-invoice-handoff-ready decision remains uncleared.

The operator approved resumption after the earlier automatic-review stop, and Delivery's local recovery and proof then ran successfully. Actual PostgreSQL tests confirmed ordinary-writer deadlocks in both Delivery 817cf5a and Revenue 072ef293. Delivery reproduced row-first versus advisory-first ordering; Revenue invoked the real Sales ordering and lesson-consumption functions and reproduced their opposite ordering. Both tests rolled back their synthetic changes. An initial drain cannot cure recurrence after incompatible writers resume.

Delivery's corrected final candidate is 51cf142c1e24863fafadc09f5b5541ce068246f0. Its schema-independent precursor f8207229687f513d05eb5ca730e76fbcdb081e8f, based on the exact prior live source, is now Ready and promoted as dpl_CorgoHi8xLHZuFTDnWe5SRFej4Ea at 2026-10-03T00:17:42.902Z. The identical six-file fix takes the native schema advisory lock before transaction row/resource locks and handles lock timeout and Prisma late-admission rollback safely. Ten actual PostgreSQL cases passed. Final candidate passed 911 unit plus eight audit tests; precursor passed 647 plus eight, with both typecheck and smoke checks passing. Delivery's published correction memo is in coordination commit 2ae53ea.

The precursor upload was a clean exact source archive, with all 617 uploaded file hashes verified. Its build overlay was only npm run build && npm run smoke, preserving all five cron definitions and executing no ensure, migration or db-push command. Fresh target checks found the unchanged 42-row migration journal and no pending migrations relative to the precursor. Actual staged and canonical nonexistent-lesson reads verified runtime database access without changing a customer. Handoff admission remains false. CLI-inferred parent-checkout Git metadata is not its source attestation; the explicit source metadata and uploaded bytes are.

Platform verified canonical/project aliases and all five cron routes point to the precursor, moved the remaining main-branch alias to it, and set the documented Vercel skew threshold to its creation timestamp, 1790986515996. The 12-hour maximum age and existing authentication protection remained unchanged. A canonical request pinned to the old deployment returned the precursor's build assets. Actual deployed function caps are at most 300 seconds; the recorded earliest guard window is 00:25:30Z after the conservative last-old-admission bound. A 00:20:43Z database observation found no Delivery relation locks or transactions older than that bound. This does not claim that every authenticated administrator is technically prevented from invoking a retained old unique URL. Such old-code invocations and uncorrected manual scripts are excluded from the release window. Final guard DDL remains held for post-bound observation and fresh target/journal checks. Revenue's correction and precursor are still being prepared.

Platform's exact released source 195a9f4 is published at remote branch codex/adr0051-person-resolution. Saved production Person-resolution enablement and the accepted Coaching workload subject were updated and read back successfully at 00:11:43Z. ADR-0051's separate owner completed its portal, replay and cleanup evidence in closeout 1071650; that result does not clear ADR-0049's handoff gate.

The authenticated production Sales mart route returned HTTP 200 for September 1 through October 3, with both handoff_count and its compatibility alias equal to one. The configured warehouse source query independently returned one for that period, 16 distinct historical handoffs overall and no duplicate tenant/Lead keys. There are no invoice-paid handoffs yet. The saved warehouse credential is sensitive and masked, so the local connection is not claimed as credential-equality proof; the live route separately establishes working production reporting. Its normal GET updates metric freshness and snapshot bookkeeping, not Sales or financial facts. Evidence is retained in Platform .tmp/adr0049-live-reporting-route.json, .tmp/adr0049-warehouse-local-target-check.json, and .tmp/adr0049-delivery-turnover-control.json.

An optional backup refresh started at 23:50Z but stalled without producing archive bytes. Platform stopped only that owned read-only process and retained the failed attempt as invalid. The earlier verified 21:59Z encrypted snapshot remains intact. The coordinator accepted that existing recovery point for the additive Sales release under the operator's explicit free-backup-or-proceed-without instruction. No paid backup or new backup prerequisite was introduced.