Revenue approves explicit closure lineage and composed settlement interfaces

Revenue explicitly acknowledges and approves the design in ADR-0050 within its financial ownership remit. The approved Revenue re-evaluation sub-spec v1.1.0, strict schema and normative examples define the exact seven-route interface. Delivery's additive sub-spec composes the same upstream evidence. No remaining Revenue design objection is withheld behind an unspecified implementation choice.

This is design approval, not a runtime or release-readiness assertion. Runtime source remains915ee657 with evidence-only head3359395. Accepted design and contract publication precede implementation. Deployment and activation additionally require all named database, writer, migration, financial, authentication and end-to-end proofs. Existing Revenue closure v1.0.0 remains unchanged with no deprecation.

Approved financial and consumer boundaries

An admitted predecessor and an unused-key settlement are independent fields. Unused old keys never become financial operations, receipts or generations. Exact old-intent request/version/fingerprint and authenticated scope remain immutable. Rejected UUIDs are permanent audited outcomes outside the admitted chain. Version-specific reads, original-key replay and exact scoped head lookup never infer a predecessor from recency.

Actual predecessor settlement requires explicit safe abort and the full immutable NoncommitProof. Historical v1 reaffirmation records a new serialized audit fact through the unchanged command and response, not fabricated old evidence. The additive proof read supports both original command versions. Delivery stores original operation/version/fingerprint plus abort_request_fingerprint; no settlement UUID is invented for actual admitted abortion. A key-settlement actual_operation result is only a reference and never terminal settlement evidence.

At eventual admission, Revenue atomically claims the successor slots of every distinct unused ancestor target for the same admitted operation, alongside financial head CAS and parent uniqueness. This prevents an old settlement alias from creating another successor after the first actual successor aborts. Root admission requires verified empty financial history; a real parent remains the exact same parent across unused descendants. Cycles, missing or changed ancestors and size/depth overflow reject without flattening history.

Delivery's schema binds ReleaseReevaluationRequest, release-only Receipt, release-bound NoncommitProof and NeverAdmittedRecord. It projects full authorized upstream proof to Sales. Sales gains neither release mutation authority nor unrestricted settlement/proof lookup; it independently verifies actual completed release and current assessment through version-correct correlated reads. Explicit ledger_reversal_created:false remains required for release completion. Current financial contradictions prevent finalization despite an immutable historical receipt.

Revenue head uniqueness remains tenant/kind/resource. The final Delivery clarification uses UNIQUE(tenant, lesson) across operation kinds, preventing parallel soft/held heads while preserving immutable kind within a root. No payment, refund, lock, completion or ADR-0049 handoff policy changes accompany this approval.

Concrete migration design and retained proof gates

The writer barrier uses a migration-role-controlled required epoch and admission switch, compiled transaction-local writer epoch, BEFORE STATEMENT guards and the existing480048 advisory boundary. Runtime roles cannot own protected objects, alter the control row or bypass guards. The epoch marker alone is not a security boundary. Quiesce and drain incompatible workers and provider continuations, reconcile all unresolved external attempts, validate graphs from exact historical edges and only then permit new admission. Genuine incoming money truth remains recordable through compatible recovery while closure admission is disabled.

Rollback disables new admissions while retaining epoch, guards, permanent keys, head/settlement history and compatible recovery. Old binaries and destructive down-migrations cannot return after new admissions. Database triggers cannot undo an already-issued provider request. Unknown external work stays quarantined and cannot produce a settlement proof.

Mandatory implementation evidence includes exact DDL and role privilege review; exhaustive admission/recovery/provider writer coverage; old-worker drain; graph quarantine and migration checks; both winners of mixed-version and transitive CAS races; non-admission versus delayed release; atomic rollback of partial ancestry claims; same-key recovery after head advance; response loss, process restart and abort/reaffirmation boundaries; all competing financial/completion/binding writers; and compatible rollback. Platform's auth approval does not certify database privilege separation. Isolated proofs do not establish production readiness.

Review evidence and immutable audit pins

Revenue's approved draft schema hash was 495b77e06bef50b345016951774e8e6b8c9ca06af06bb367e4073cea5f099959. Its36 definitions passed46 positive/negative schema cases with14 canonical fingerprint vectors. Delivery's byte-identical upstream snapshot composed with Delivery schema b230a5ce8451db42c9d5c8b268b446a5998eb14b6b50b78139f0d270dd1ed2e6 and full response examples 34907c4c1b4460d274b3042bf50acc743fff5faa903493b853f633b2c454aba6. Revenue independently passed all27 Delivery responses plus8 targeted acceptance/rejection checks through strict AJV,35 composed checks total.

The final reviewed Sales ADR draft hash was 3016f6153f75f12e0c31926fc016e775a956a196c6ff82d0be976b7c2d8a51e9, incorporating the Delivery cross-kind uniqueness clarification. It superseded earlier audit pin 1ffc86663b81e4e0f2018943d7487b851cfaf651477e6e273a2c863f684baf9a without changing Revenue authority.

Publication schema hash f5ef0fb4c7bebd4f0a365a077f1f3df6a7c55851ddf772031248f31d6a06fd3e differs from the approved draft only in logical schema ID and title; definitions are identical and fingerprint vectors unchanged. Relative canonical references replace draft references. All46 schema cases pass against the publication schema. These checks establish reproducible grammar and composition only, not authorization, financial eligibility, database concurrency or provider safety. Existing612 runtime tests predate strict1.1 and do not prove the new protocol.