Revenue specifies bounded compensation writeback and requires current evidence linkage
Assignment ADR-0053/revenue/003; coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc, host local; Revenue participant 01a0ff07-dae9-7ed3-9b27-0fd2c4dcc6fe. This is an explicit proposed Revenue position for the coordinator's review PR. Revenue supports the sequence and the financial choices below, but withholds formal acknowledgment pending observer linkage, the Order event inventory, and joint consumer/policy review. No canonical contract, ADR, runtime, policy, deployment or financial record is changed. Root remains the sole publisher and indexer for this batch.
Exact reviewed package and source
Platform ADR-0053/platform/003 manifest: C:/Users/jallr/.codex/worktrees/adr0052-service-auth/platform/.tmp/adr0053-platform-003-draft/manifest.json, SHA256 865c8ab775434e1d4b84484e68a8ee19eed24d5e21a934e801cae196f3b08de4. All 17 listed artifact hashes and byte sizes match. Important reviewed artifacts are compensation prose 0bf254da144f31e57a3aa43a494103237b2322bf427c42b0914f47527bba3ae5, compensation schema c32c68f5d99b62d0c5fc6dced3d808511e14340b0548c93daaa5cf87b7c39b96, financial writeback 7d14cbf10c85362ea3214366657db063ab10009cf513d8842f7f07984175580d, and proposed ADR-0006 amendment cbd71e023c13cb4801d6b0e155d0381f5d7f395c151a764b98f0e34f92e56499.
Revenue's unchanged baseline assessment is C:/Users/jallr/.codex/worktrees/revenue-adr0052/revenue/.tmp/adr0053-ordering-draft/compensation-owner-assessment.md, SHA256 8c6e29dd09f6208defc1f37158263f37991e9f2931e60b75de3286e9141f39ed. Accepted source is coordination 43cd36bc312cdda3e1e2543215df55a7ace52ab1, particularly credit-reservation-lock v3.5.0 sections 4.3, 6.1, 9.6, 10.1, 12.3 and 12.4; reservation-release-api v1.1.0; delivery-state-vocabulary v1.0.0; order-flow v1.1.0 sections 4.2 and 5; and the event registry. Revenue candidate d24da76a84e7fc72dc909a1d84c748e9d11d8d65 supplies the release, Order status/publisher, scheduling attempt, sender and abandoned-continuation source checks. Delivery's owner position remains e8d355052234fb20e17db431d322c80ae6c7059a.
Revenue decisions for the proposed patch
Prefer Delivery's atomic operational cancellation first: protected g becomes compensating g+1, Lesson becomes Canceled with outcomeVersion 1, and its operational hold becomes released with lockVersion incremented once. Revenue's canonical reservation remains reserved/pending until its own financial writeback. Accepted vocabulary already gives those fields different owners and meanings. All slot, uniqueness, configuration, original association and replacement exclusions remain effective during compensating. Generic cancellation, financial projection and event consumers cannot clear that protection.
Adopt the proposed dedicated private Revenue transition, only for the exact original failed close's reserved reservation, funding PENDING_FUNDING, no lock debit, no executable invoice/payment, no unresolved or unknown preparation/provider/internal writeback, and no contradictory retained fact. Every original admitted attempt must be terminal and nonexecuting, every potentially committing original sender fenced, and no-new-collection irreversible. An issued/executable invoice, unknown provider outcome, funded/locked reservation or late-payment obligation denies this authority. A definitive provider decline does not itself prove all of these predicates.
In the single owner transaction, recheck exact authority, original association, command digests, Delivery result bytes/hash and receipt, reservation/intent revisions and compatible writer epoch. Change only the original reservation to RELEASED, retain compensation identity, resolutionReason and decision times, and cancel only its unfunded original Order when no executable or unresolved financial action exists. Persist immutable writeback proof, transactional outbox and irreversible abandoned continuation after all original compensation work is resolved. Protection disappearance is not a prerequisite. The guard exception must identify these precise rows, authority and verified receipt, with exact permitted source/target fields; a bare marker or generic abandoned state grants nothing. The ordinary release API remains guarded and cannot serve as this private transition.
Adopt new reason failed_close_compensation, initiator system_other, reversal_reason Credits Released, credit.released@2 envelope actor system:revenue, subject the original reservation ID and correlation_id the compensation key. Retain cancelled_at at Revenue's financial decision, separately from Delivery's earlier cancellation time. released_credits is the original reserved claim quantity, not a new balance credit. Same receipt replay emits nothing further. There is no Adjustment, ledger entry, debit, forfeit, purchase, refund, balance change or customer.handoff. Do not substitute administrative_void for every failed close or widen ordinary release/forfeiture/refund authority.
For the proposed compensation evidence dialect, adopt pending_funding as the explicit wire mapping of DB PENDING_FUNDING, including on the historical released reservation. It means no funding occurred, not an executable payment obligation or an awaiting-payment replacement. Existing funding-state contracts retain their own field vocabulary. Adopt WritebackProof order_status: Canceled as the display mapping of DB CANCELED; order-flow payloads use canonical DB status strings. Document both mappings rather than propagate display spelling into financial events.
The proposed ADR-0006 amendment correctly needs to add the Revenue-originated auto-release cause in section 6.1, its event/time semantics in section 9.6, and the reserved-only/unfunded trigger restriction in section 10.1. Generic locked release semantics remain intact. The new reason's schema description should also enumerate and define this cause; its current enum adds the value while the prose description still lists only the older auto-release set and describes the reversal as an Adjustment. Clarify the prelock zero-ledger case in the candidate documentation.
Required Order event inventory
Resolve the currently open inventory decision: canonical Order cancellation changes a load-bearing status, so order-flow sections 4.2 and 5 require exactly one order.updated@1 in the same writeback transaction, in addition to exactly one credit.released@2. Do not invent order.cancelled, omit this existing event or replay order.created. Revenue proposes actor system:revenue, subject original Order ID, correlation_id compensation key, updated_via failed_close_compensation, updated_at the retained writeback time, status_from the actual eligible pre-writeback DB status and status_to CANCELED. Preserve amount_total and the actual prior unpaid amount; require amount_paid_cents_to 0 and no paid funds before authorization. Use existing required payload fields and open-string source/status compatibility. The accepted README's known CANCELLED spelling must be reconciled explicitly with current DB/publisher CANCELED, not silently copied from display Canceled.
Extend retained WritebackProof and its digest input with order_updated_event_id for this mandatory Order transition, correlating it to the existing credit_released_event_id and same atomic writeback. With this draft's unconditional Canceled Order proof, an already canceled row from another command cannot count as first successful compensation. Missing either required event, receipt/proof failure or state-write failure rolls the transaction back. Proof counts become one Delivery operational cancellation event, one Revenue credit release event and one Revenue Order update event, with zero ledger entries and unchanged account balance.
Two operations and current observer linkage
Support the explicit closed two-operation union at the proposed SAME compensation POST route and sole scope: reservation.bind.compensate with rcomp1 and reservation.bind.compensation.finalize with rcompfin1. Finalization needs a separate retained command, fingerprint, response and generation consumption. It changes only compensating g+1 to retired g+2 after exact owner-writeback evidence; it does not repeat cancellation, change Lesson/lock versions or permit another bind/refund. Platform and Delivery must explicitly approve this operation-to-policy mapping. Its presence in schema does not grant it through an accepted ADR-0052 bind/settlement credential.
The evidence union still lacks an explicit current observer linkage. AuthorizedEvidence exposes only frozen Authority plus fresh as_of; CompletedEvidence adds immutable WritebackProof but no current assessment. Authority reservation/intent revisions and quiescence predicates are admission observations. Updating as_of cannot turn them into current revisions or prove that no contradictory observation arrived. Prose requires later contradictions to block progression, but the closed schema cannot report a current assessment alongside retained historical proof. The validator's final-correlation model also compares the command to writeback without checking the enclosing authority against that proof; recipient cross-checks must include all three.
Revenue proposes a separate closed current_assessment on authority-bearing observer responses, linked to the same association, compensation identity and AuthorityRef. It must contain a monotonic assessment revision, observed reservation/intent revisions, current writer epoch, current lifecycle/funding/continuation values, retained-facts digest, contradiction/unresolved-work assessment, and an explicit eligibility decision/reason for the requested compensation or finalization operation. These are new proposed observer fields, not existing persisted implementation. Keep immutable Authority, original result bytes, WritebackProof and their digest preimages unchanged. Define assessment digest and exact inclusion/exclusion rules in the assembled schema, rather than recomputing authority with newer facts.
Frozen admission revisions need not equal newer observation revisions. Require ordered revisions, matching irreversible sender epoch/barrier and authoritative current eligibility; classify allowed progression explicitly. A new unknown provider/internal action, missing barrier, unmatched receipt, changed association or contradictory fact produces pending/denied eligibility and blocks new compensation/finalization. Historical successful receipts still replay exactly and may remain visible with a blocked current assessment; they never reexecute effects. A fresh GET only reads durable owner state and does not allocate authority. A snapshot timestamp cannot solve inter-domain races, so retain permanent sender fences, compatible owner serialization and each owner's last local predicate recheck. Delivery retains protection through financial failure or contradictory observations, and Revenue records genuine incoming truth without reopening collection or implicitly authorizing refunds.
Compatibility, implementation boundary and review evidence
The financial transition needs new ADR-0053 authority and the explicit ADR-0006 amendment. Conversely, durable original attempts, bound history, producer-transactional emission, truthful incoming facts and original guard coverage are accepted ADR-0052 obligations whose missing implementation/proof remains a handback issue. New compensation IDs, authority/evidence storage, two operations and compensating guard exceptions are prospective; no current runtime handler or privilege is inferred. Revenue's candidate checkout remains clean at d24da76, with ADR-0052 implementation paused and isolated fixtures preserved.
Credit-reservation-lock 3.6 and scheduling 2.1 remain candidate minor versions only after checking strict reason mirrors, Delivery operational-event consumers, Sales replacement/cadence behavior, Order consumers and warehouse/resource readers. Required changes to existing consumer behavior or writable authority need an explicit migration/version decision. Preserve accepted scheduling v2/ordering v2 and all four accepted ADR-0052 policy rows. No older binary may clear compensating protection or dispatch original financial work.
Platform 003 alignment notes propose different descriptor denials from Revenue 002's retained draft. Following the coordinator's Sales 003 correction delta, Revenue explicitly chooses this proposed shared table: malformed transport/canonical artifact bytes/namespace/version is HTTP 400 validation_failed; valid workload but unapproved signer/issuer/audience or invalid signature is HTTP 403 forbidden; exact accessible identity with changed request digest is HTTP 409 conflict / idempotency_payload_mismatch, and changed descriptor/admission identity is HTTP 409 conflict / admission_identity_mismatch; retired/revoked/compromised unverifiable unseen artifact or unavailable/stale trust/history is HTTP 503 recovery_unavailable. Non-conflict conflict_reason is null. Preserve existing workload 401 UNAUTHENTICATED and workload-scope/reach 403 taxonomy, uniform nondisclosing missing/foreign association behavior and nondisclosure before authenticated reach. Denials settle nothing, consume no original key/tombstone and never dispatch collection. The assembled error schema and vectors must define layer precedence explicitly. This is a prospective replacement of Revenue 002's artifact 401/409 proposal, not a rewrite of its retained manifest 70016cced1f8bd1558a5f51a884b4cd58d4d7d19a51cb8e7438a411446ccbfaf.
Sales 003 memo C:/Users/jallr/Documents/Sguild/repos/sales-coordination/memos/2026/2026-10-02-sales-adr0053-corrected-ordering-and-preparation-position.md, verified SHA256 56c8d5d308398e05ef97fdeaf3c072edbd74908b26c20539e74a6a9fea7ce716, reports the current system_other/failed_close_compensation consumer reaches generic cancelled/other/lesson_scheduled display and paused cadence, without journal completion. Treat its truthful pending adapter and exact correlation as an explicit Sales consumer gate. Keep the blocker through writeback/finalization response loss and require current authoritative resource assessment plus exact g+2 finalization proof for retirement. Historical receipts alone do not prove current replacement readiness. Sales also supports the full 8192-byte signed artifact and 65536-byte outer original-close budgets, pre-soft preparation reservation and final byte checks, plus UNIQUE/sign-once original admission. Revenue agrees as proposed assembly requirements; none is retroactively established by existing journal source.
For new protocols, all body numeric fields are nonnegative integer tokens, exactly safe and without decimal/exponent or negative zero. Revenue 002's general lexical reader also accepts negative safe integers before field validation; actual current fields still reject them. Joint examples must distinguish generic lexical tests from valid wire bodies.
Independent static review: C:/Users/jallr/.codex/worktrees/revenue-adr0052/revenue/.tmp/adr0053-revenue003-review/review.mjs and review-report.json; report SHA256 7a76a84b713fd2dfcfadac3aa802746473d264fb3a886fc87e6ea78bb8a11e3d, 19 checks passed. It verifies package pins, evidence variants, two operations, frozen-authority rejection and the observer omission, with eight simple proposed denial-table assertions. The denial model is a review choice, not a test of an assembled error schema or handler. It demonstrates a fresh timestamp with unchanged historical authority remains schema-valid, while adding current_assessment fails the closed schema. This is static review, not proof that a runtime handler wrongly authorizes it. No Platform script was executed or modified.
Live ledger discovery at 2026-10-03T02:18:10.845Z found no ADR-0053 pending/working commitment for this review to complete. Runtime checks were not rerun because no Revenue runtime changed. Root should assemble the proposed observer/event amendments, obtain Delivery/Platform/Sales review, and publish/index/freshness-check this exact memo within its designated batch. No formal acknowledgment or production readiness is claimed.