Revenue source comparison narrows deployment uncertainty but catalog preflight remains blocked

No migration, deployment, activation, source push, provider call, financial fixture or replay occurred. The initial Vercel application catalog check was blocked on target binding; a subsequent separately authorized Render producer binding allowed an explicitly read-only producer catalog check. This finding does not clear any release gate.

Observed source and deployment

Authenticated Vercel GET confirms deployment dpl_DH9BwUY6AatGaLkrG4taw3NtNGw9 belongs to Revenue project prj_RC4agHgOQawL2yann5nVUSdbkVzy, target production, READY, Node24, commit metadata f7b8ad71dea126ba34ca615b4e4004c07a348627, gitDirty1. Coordinator alias evidence separately maps revenue.sguildswim.com to this deployment. Current managed candidate checkout is clean at evidence-only 3359395b33e982b3f8b23f6cfdb4ce70a4c92362; runtime correction is 915ee657d4d5c6c205a26c180a978a26d9864f41.

The authenticated deployment-file manifest contains758 uploaded src files. All758 content UIDs match the metadata baseline's tracked file contents:749 after explicit LF-to-CRLF conversion and9 as exact raw bytes. Three baseline tracked files are absent from the upload: .env.test.local, .gitignore and .vercel/project.json. There are no unmatched uploaded source paths within that758-file manifest. This materially narrows gitDirty uncertainty for uploaded source, although it does not establish immutable environment or compiled artifact equivalence.

Candidate comparison:739 files match with CRLF conversion,9 raw matches,10 changed uploaded paths and41 candidate tracked paths absent from the deployed source manifest. The10 changed paths cover JWT verifier, dispatcher and its tests, reservation release serialization, invoice link and order charge writers, ordering-surface tests, Prisma schema and local audit/test scripts. The absent set includes all six new guarded-closure/payment-handoff API route files and both new migrations. Evidence source-comparison.json gives every path and content identifier; this is a complete tracked source comparison against the uploaded manifest, not a claim that source was deployed.

Production catalog boundary

Current production project configuration includes sensitive DATABASE_URL and DIRECT_URL metadata. Both list and exact single-variable authenticated GET omit the DATABASE_URL value, even when requesting decryption. No URL, host, database name or migration target was inferred from local env files. Therefore production migration journal, checksums, tables, columns, function definitions, trigger enablement and runtime role privileges are NOT VERIFIED. No observed schema gap can honestly be asserted without that catalog read.

The expected accepted48/49 migration prerequisites are recorded verbatim with file SHA256 in evidence.json:

• 20260927020000_onboarding_closure: closure_revision on reservation, three closure journal/binding/fence tables, shared advisory serialization and revision guards.
• 20260927030000_payment_handoff_assessment: clock and settlement provenance tables plus21 statement serializers and21 revision triggers sharing the same480048 lock. No historical paid provenance is inferred or backfilled.

Next catalog check needs an authenticated production-target-bound read path. It must use connection-level default_transaction_read_only=on plus BEGIN READ ONLY, restrict reads to catalog and migration metadata, verify expected object definitions/trigger enablement and applied migration checksums, then roll back. Do not run Prisma migration commands merely to inspect readiness. An unbound local URL cannot substitute for target evidence.

Follow-up: exactly bound Render producer catalog

The coordinator supplied authenticated saved Render worker configuration for service srv-d7u4fq9j2pic739goqg0, source d61bae6. Platform's authorized producer DSN matched every supplied field: aws-1-us-east-1.pooler.supabase.com, port6543, database postgres, schema revenue and project reference pfuctqiobbjglpukteei. Credentials remained private. A connection with default_transaction_read_only=on plus BEGIN READ ONLY returned transaction_read_only=on; all reads were catalog/migration metadata, followed by ROLLBACK.

This Revenue producer schema is not ready for the48/49 candidate. It has42 base tables, no onboarding_closure or payment_handoff tables, no closure_revision column, zero closure/handoff functions and only two existing noninternal triggers (fixture-spine rejection and dispatcher notification). Neither expected48/49 migration appears in the public25-entry or revenue49-entry migration journals. No expected checksum can therefore match. Exact catalog evidence is render-producer-catalog.json. These are observed gaps on the matched Render saved producer target, not a claim that the masked Vercel application DSN is identical or that saved Render values certify immutable running-process environment.

The credential's database role is not superuser but has create-role, create-database, replication and bypass-RLS privileges. This cannot establish the least-privilege runtime role required by the future0050 design. It does not identify Vercel's runtime role. Keep that separate privilege-separation gate explicit. No roles or grants were changed.

The production preflight now has concrete producer-side migration gaps, while Vercel application target equivalence remains unverified. A production migration plan must inspect and bind the actual application target before any authorized apply; it cannot treat this producer read as automatic authorization.

Assessment and workload prerequisites (unchanged)

The current production project env metadata has no REVENUE_PAYMENT_HANDOFF_ENABLED key. Candidate route code requires literal true after authentication, otherwise503 assessment_disabled; the same flag gates new settlement recording. This is current project configuration evidence only, not immutable deployed environment certification. Presence of sensitive PLATFORM_JWT_ISSUER, PLATFORM_JWT_JWKS_URL and PLATFORM_JWT_AUDIENCE names establishes neither their values nor live issuer/JWKS/claim compatibility.

Before release, verify the bound production catalog, exact clean deployment source, actual runtime environment, canonical tenant versus organization reach and exact Sales/Delivery workload subjects, audience and assessment-read scope. Then obtain authorized deployment/read-only route evidence and staged flag/route enablement through the existing coordinator release gates. Do not reconstruct missing historical settlement provenance or replay payments just to create eligibility. Local612-test/typecheck/writer evidence remains isolated proof, not production financial validation.

The ADR-0050 draft and its new writer-epoch design are not part of this48/49 runtime candidate. No future lineage migration is included in the catalog prerequisites here. Production readiness remains blocked on the named release evidence and authorization.

Sanitized source and catalog evidence records exact source hashes, target qualification, metadata, catalog definitions and migration comparisons. The live ledger was checked on October2; the broader Revenue ADR-0048 working commitment is not satisfied by this bounded release preflight and remains unchanged.