Closure migration rehearsals pass with explicit runtime-role and provider gates
Coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc, host local, reviewed owner assignments ADR-0050/sales/007 through /009 and ADR-0050/revenue/005. This records local readiness and a bounded release-review disposition. It does not claim production migration, activation, live provider proof or completion of ADR-0048.
Source-pinned local evidence
Sales application candidate ab6d1786fcf337406d809f578f75e717ff0ea9de adds exact production workload transports and separate default-off execution/admission controls, serializes missed callbacks with closure, resolves human authentication outside database locks and retains one durable preview identity through execution. Revenue inspection may persist validated bindings, so the preview is correctly documented as non-cancelling preparation rather than database read-only. Root reviewed the source and verified twelve source hashes and ten evidence hashes. The follow-up passed 138 affected unit checks, five fresh restricted-role PostgreSQL cases, typechecking and cadence checks. Packet SHA256: 35b813c98572e3db87fc4d944b98fe58571532fa090917aff22976cc2427a393.
Sales008 rehearsal source 66abb00119ff955cdfa36cfa3506af1a9529250a used the current production Sales schema and actual migration metadata, with synthetic rows in a fresh loopback database. It retained 93 Sales records and 25 public records, including unrelated historical failure state. Production already contains the closure unique index; only the two append-only journal guard migrations are pending. Bounded lock/statement timeout rollback, restricted-role guard protection, immutable journal preservation and incompatible old-reader rejection passed. Packet SHA256: fbca4284fde8bce60a3efa5eb202d925fcbd2aee7cae6a4a72d13e80a3eb6848. The current deployed Sales source remains 091d3c0d41e06bc4a5f476142bdded22d9a2aa49.
Revenue005 used candidate 689e8b96f415d0beb1d00e6003595b4d0fbca8c2, production source 5417af4cf384ecc91f8a1da7a671a4094993ee05, and production schema fingerprint bf4e57663b461c18d786151b5487510cc1d20821dfe14bd116d01cbfd216a52e. All 51 historical migration records were preserved, including two rolled-back entries, and three exact pending migrations applied to a fresh schema-only local replica with synthetic rows. Eleven focused checks covered rollback after each file, lock and statement timeout, restricted-role permissions, transaction-scoped entry and the common writer barrier. Prisma reports the isolated database up to date; admissions remain disabled. Root verified twenty evidence hashes. Packet SHA256: 4fc4712867c365d0ede73e075b30e81efe7ff3b14b213b680c5339cbd546e9a6.
These rehearsals preserve earlier composed fixtures. They are not copies of live business rows, production performance tests or proof that every live continuation is quiescent. Production access was limited to schema, role/journal metadata and aggregate read-only checks. Failed local attempts are retained and separated from successful evidence.
Bounded historical Sales provenance disposition
Sales009 source cd8c518d1337f03a316443ab60f7904cf75278c9 investigated 20260524173000_relink_qualified_path_prompts. The successful production checksum is 8e621959984e31ef1cbd9aea0b2e224aa4b64dcf0a4cced940b1b1c4d668436e. Available Git history does not contain those exact bytes; line endings do not explain the difference. Both deployed and candidate migration files match each other and were changed after the recorded application. Neither historical journal nor SQL was rewritten.
The read-only checks found all nineteen seed prompt/channel pairs, no differing links among ten currently eligible template mappings or one hundred queued/in-progress qualified actions, no forbidden legacy links, and no eligible unreferenced legacy prompts left active. The two null prompt links are step-five close actions outside the migration's mapping. Both known versions are data-only SQL. These facts establish current scoped invariants, not the unknown applied bytes or historical effects. Owner document SHA256: f68c6a52d33b3fa6abdbd9f56f07ed59ec69eab0e6a1918594ef9d07e63735af; forensic evidence SHA256: 39b781d87d948708d5e9fa259f4ae35e5bd0a478b292391de8ae14fe7e85cab2.
Within the user's delegated coordination and release authority, the coordinator accepts this documented provenance limitation as nonblocking for the prospective closure guard release. The closure migrations were rehearsed against the current schema with the original journals preserved and do not replay or depend on that prompt data migration. No corrective data write is justified by the observed invariants. This acceptance is limited to this release assessment: it does not certify the missing source, normalize a checksum, authorize historical replay, resolve the unrelated public failure, or permit changes to operator-owned cadence data. Preserve the discrepancy and seek the original artifact if it becomes available. Any future unmet cadence invariant needs a separately scoped forward correction and idempotence proof.
Remaining release gates
Both owners verified that Vercel lists the deployed sensitive database variables but does not expose their values through the available API. Their direct inspection connections therefore do not prove the serving runtime role. Obtain sanitized identity/privilege evidence from the actual serving connection before configuring restricted runtime credentials and draining incompatible writers. Do not revoke a shared postgres role globally. Keep migration credentials out of normal serving use and retain compatible disabled rollback binaries and immutable journals.
Revenue real Square Sandbox evidence remains pending the existing webhook ownership decision. Production provider preparation/writeback continuations still require classification and drain; schema-only proof does not establish financial quiescence. Producer guards and verifier configuration, actual workload authorization, integrated ADR-0052/0053 code, full supported-flow proof and coordinated deployment/activation remain open. Existing cross-domain implementation commitments stay unresolved until their named deliverables are established.