Revenue resolves ADR-0053 design choices and identifies one recovery assessment transport blocker

Assignment ADR-0053/revenue/004, coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc, host local, participant 01a0ff07-dae9-7ed3-9b27-0fd2c4dcc6fe. Reviewed coordination PR 4, exact head af45908fc13ce698097e6ff6dbde66bbdb37bc4b, as a proposed design. All 44 mapped files match that commit's Git blobs byte for byte. Scratch manifest SHA256 is 2df1abfe3d5cef3e62f0bd1b69107705daa45779978e44c78f13a1a5e3092953, file-map SHA256 624da6a1d13c5c324ee53f403a3c3fc48d97f1f77e950cb8a0c59afdbafd6bcf, and all 93 manifest files match their hashes and sizes.

Revenue approves the bounded recovery, trust and financial design choices below. One genuine interface blocker remains in this exact head: Sales cannot obtain the evidence required to retire its original compensation blocker through its authorized recovery response. Accordingly this memo has no acknowledges field. Missing future runtime proof is not the reason for withholding design acknowledgment. Once the explicit transport amendment is assembled and reviewed, the listed implementation/proof commitments remain release gates, not an additional requirement to accept a complete design.

Resolved Revenue design and version position

Approve ordering 3.0.0 with the same original UUIDv4 in sclose3/ssh2, mandatory saved descriptor, normalized digest, inline/link/no-payment package motions, permanent original/tombstone registry and separate sole recovery scope. Preserve v2 bytes and isolate legacy records; no retrospective signing, capture substitution or arbitrary unseen-key tombstone. Approve the layered 400 validation_failed, workload 401 UNAUTHENTICATED, artifact 403 forbidden, identity 409 conflict with the two specified reasons, and trust/history 503 recovery_unavailable table. Denials grant no settlement or financial effect.

Approve service-auth 1.9.0 as additive, keeping four ADR-0052 rows unchanged and adding exactly the proposed four rows. Approve the two-operation compensation/finalization union at the same new POST/scope; no generic cancel/refund or fifth policy. Approve credit-reservation-lock 3.6.0 and the bounded ADR-0006 amendment as an additive cause mapped to existing reserved-to-released semantics. credit.released@2 remains schema version 2 with the new reason; order.updated@1 retains its existing required fields and open status/source strings. Strict reason mirrors must migrate before the new value is emitted. DB CANCELED is the new event's status_to, display Canceled remains a display mapping, and order-flow's documented known CANCELLED spelling requires an explicit explanatory reconciliation.

For the shared parent choices, Revenue selects Identity 2.0.0 and sales-scheduling-surface 3.0.0, rather than the conditional minors. Identity section 9.5 currently says consumers SHALL re-key historical snapshots; the proposed immutable-artifact exception changes that obligation. Scheduling section 4.1b directs abandoned successful binds through ordinary hold-cancel; section 4.7 says cancellation drives Revenue release and enables replacement without repurchasing; status-based terminal-resource readers must now preserve compensating protection. Those are existing consumer duties, not merely new optional wire fields. A major makes the changed duties explicit, while retaining original bind protocol 2.0 and new compensation protocol 1.0 as separately versioned sub-specs. Ordinary hold-cancel bodies and existing event payload fields remain unchanged. Platform and Delivery retain approval ownership for their parents; this is Revenue's concrete compatibility disposition for the assembled acceptance metadata.

Replacement text for Identity 9.5: "Re-key mutable role, operational, display and lookup references on person.merged. Preserve immutable originally admitted command bytes, keys, descriptors, digests, receipts and append-only financial provenance under the original Person ID, with verified original-organization lineage for authenticated historical access. Never rewrite those artifacts or inherit original reach from a target tenancy."

Replacement for scheduling's failed-close/terminal implication: "An exact failed-close bind uses the dedicated compensation sub-spec, retaining protected-to-compensating-to-retired generations. Canceled Lesson or operational released hold does not free the original slot or replacement obligation while compensating. A cancellation or credit event alone never proves financial writeback or retires that obligation. Ordinary hold-cancel semantics apply only to their independently authorized ordinary flow."

Publish major-version migration timestamps with actual accepted metadata. Preserve the existing ADR-0052 deadline 2026-10-17T00:42:57Z; no restart or extension. If the new migration cannot complete by the applicable deadline, pause/quarantine affected admission, drain unsafe senders and escalate. A migration deadline never expires a fence or permits insecure fallback. Existing ADR-0049 production and candidate activation flags are unchanged.

Identity freshness and historical reach

Approve fresh coherent Platform verdict per relevant attempt, fetched outside local locks, as point-in-time eligibility. Revenue does not require identity to remain unchanged at the exact remote Delivery commit instant. evaluated_at is not a lease; local owner revisions, booking eligibility and immutable original-association predicates are rechecked at mutation. Current workload authentication and exact tenant/Organization reach remain mandatory before any historical disclosure. Do not claim cross-domain linearizability from a timestamp. A future requirement for commit-time Platform identity exclusion would require a new invalidating-writer fence design.

New writes require exact active canonical requested Person and active original tenancy. Immutable replay and narrow unwind may use archived Person or paused/inactive original tenancy only with retained original pair, verified same-organization lineage and exact owner-admitted association. Merged-target tenancy alone grants nothing. Missing or ambiguous lineage remains nondisclosing pending/unavailable. Keep mutable customer-facing references canonical; never re-key immutable commercial evidence or relabel original authority. Revenue reads Platform identity through approved service APIs, with no direct Platform DB access or local canonical Person fields.

Descriptor trust and storage decisions

Approve dedicated Sales RSA 2048-4096 RS256 signing, sign-once durable prepared admission and audited exact compact bytes, separate from Platform workload keys. Sales owns key custody, authorized human evidence and internal signing permission. Revenue verifies the exact 22-field assertion and canonical bytes against statically approved public SPKI and never treats its hash, claimed times or signature alone as payment/booking permission. Signer reloads its durable prepared record and cannot sign caller-selected claims. Revenue need not query Sales' private journal; the approved key attests that gate. Sales must freeze its nonsecret evidence serialization before its signer is enabled.

Select these Revenue logical stores: (1) immutable key metadata keyed by kid with SPKI hash, issuer/audience/algorithm and approved config generation; (2) durable tenant/issuer trust watermark with serialized key-state decisions and append-only trust audit; (3) original admission registry uniquely keyed by tenant/Organization/issuer/operation/original admission across namespaces, plus unique close key, exact descriptor bytes/hash and full original normalized command/owned association. Admitted and never_admitted states never convert; terminal responses and settlement receipts never mutate or expire. Database object names and migrations may follow module conventions without changing these invariants.

Use the common Revenue financial/admission writer barrier before row locks for trust changes, unseen original admission and unseen tombstone insertion. Recheck configured generation against the durable watermark inside that serialized decision. Static public bytes, env rollback or old binaries cannot restore trust. Before every new outbound provider/preparation/bind attempt, recheck the original admission, current trust decision and sender generation under the compatible durable guard, then release locks before HTTP. Revocation can fence unsent attempts, but cannot erase an already authorized external send; any resulting genuine fact remains retained and reconciled. Permanent compensation quiescence requires resolving all such in-flight uncertainty.

Stage the new public key at Revenue before Sales activates it. Retire the old key after inventory/drain; never resign unseen late commands. Retired keys permit exact independently admitted continuation under current workload/owner predicates. Revoked or compromised keys permit only independent fact reconciliation, not new provider preparation, collection, bind or financial attempts from that artifact. Retain old public keys and exact artifacts for inspection, with no admission restoration from claimed pre-compromise timestamps.

Approve the specified inline-token SHA256 commitment as an equality binding, not a confidentiality or entropy guarantee. Limit actual inline capture to the existing provider-tokenization motion, keep original credentials in Revenue's approved private execution storage only, and restrict descriptor/journal disclosure to authorized original reach. Do not log capture tokens or publish commitments indiscriminately. The current parser accepting arbitrary nonempty strings is not evidence of provider token entropy. Real provider-bound ingress, private-storage/log-redaction and token-family security evidence are implementation gates; low-entropy general credentials are outside this design. Preserved inline/link behavior is not removed.

Financial effect, actual consumers and migration commitments

Approve exact pristine bound source and immutable quiescence authority, operational cancellation under compensating g+1, one owner transaction releasing only reserved/pending_funding/no-debit financial state, one credit.released@2 AND one order.updated@1, immutable WritebackProof including both event IDs, zero ledger/balance change, and separate g+2 finalization. The complete current assessment fixes Revenue003's observer gap: independent digest, operation, original barrier ID, source revisions, epoch compatibility and staged-fact coverage. Enclosing authority, command, receipt, writeback and assessment all correlate; blocked assessment never grants new effects, while exact immutable successful receipts remain historical.

Source inspected at Revenue candidate d24da76: service.release-api.ts denies scheduling_bind_pending and can choose generic terminal/refund-sensitive behavior, so it cannot be the dedicated writeback. order/service.charge-pg.ts establishes transactional Order event publication. scheduling-bind/repo.ts inventories guarded financial/domain tables and validates installed guard counts; service.ts records original attempts and genuine staged financial facts, while its current abandonment guard rejects any charge/invoice attempt or unreconciled funding fact. New quiescence authority is a dedicated transition, not a weaker call into those old functions.

dispatcher-inbox/service.ts handles lesson.delivered and delivery.lesson-hold.created, then defaults other event types to dedup-only processing. It currently has no cancellation consumer that releases financial state, no implemented compensation projection, and no person.merged re-key branch in this module. A 2xx/dedup is not domain writeback. Migrate relevant inbox/projection paths to stage contradictory facts and advance current assessment even when allocation is blocked. Keep ordinary lesson consumption from treating a compensated observation as new debit authority. Revenue's existing Workbench ordinary cancel caller remains separately authorized; it cannot retire compensation.

Revenue's conditional commitments cover its registry/trust implementation, exact financial and Sales-facing observer producer, and writer/reader migration proof. Inventory application writes, invoice/charge/preparation continuations, provider callbacks, dispatcher inbox, reconciliation, closure, admin/repair/raw SQL, cron and old deployments. Install prospective privileges, registry uniqueness, immutable journals, monotonic epochs and exact-row guard exceptions before enabling sends/admission; drain or DB-deny old writers. Rollback retains tombstones, original journals, uncompromised trust watermark, irreversible sender fences and compensating protection. Do not require protection to disappear before writeback. Sales owns its truthful pending adapter and blocker retirement; Delivery owns slot/unique/current-resource guards. This memo does not declare other domains' commitments.

Exact remaining design blocker and replacement transport

The failing clause is contracts/sales-ordering-surface/validation/adr0053-ordering-v3/ordering-v3.schema.json, $defs.RecoveryResponse.oneOf original_terminal branch: a closed object permitting only protocol_version, result, identity and original_response. That immutable original result cannot expose later WritebackProof, Delivery finalization g+2 or a fresh original-resource assessment. Sales cannot invoke Delivery's compensation-evidence GET, whose sole subject is system:delivery and whose recipient is Revenue. A financial event, generic canceled status or historical finalization receipt alone cannot supply the missing current evidence. This is a producer/consumer interface omission, independently of runtime readiness.

Required replacement: "The original_terminal envelope SHALL additionally contain a separately mutable obligation_assessment for the exact identity. original_response stays byte/semantically immutable. Active/pending assessment grants no blocker retirement. retired_compensation requires exact Revenue WritebackProof, exact Delivery FinalizationResult and its retained raw response hash, plus a fresh owner-authoritative Delivery assessment of the same original resources and retired g+2. Revenue may return terminal original truth with pending current assessment when dependency evidence is unavailable. Assessment changes never modify the original result, create a new business key or grant Sales compensation authority."

Concrete closed candidate is C:/Users/jallr/.codex/worktrees/revenue-adr0052/revenue/.tmp/adr0053-revenue004-review/original-obligation-assessment.proposed.schema.json, SHA256 76023ab1c459c16e894408b89e8d7a4e7bb4cadda9c60fb12e0b2ed8d8238ea4. It defines active/pending with retirement_eligible false and a proof-bearing retired_compensation branch, reusing exact existing WritebackProof, FinalizationResult and Association definitions. Add its OriginalObligationAssessment as a REQUIRED sibling only to original_terminal. Never-admitted settlement still resolves only Revenue admission; the original Sales soft hold remains a separately assessed obligation. New fresh admission always rechecks resources independently.

Producer procedure: authenticate Sales recovery under its existing exact new scope; load exact immutable original registry; obtain authoritative Delivery original-resource observation outside Revenue locks; recheck Revenue source revisions/barrier under its serialization; construct a correlated current projection without reexecuting financial work. If any dependency, historical reach, version, contradictory fact or proof is unknown, return pending retirement_eligible false. Sales validates every redundant identity, all canonical proof hashes and g/g+1/g+2 linkage, then serializes retirement of only its original blocker. No current reusable-slot claim follows from a historical canceled row.

The amended design must name HOW Revenue obtains that fresh Delivery observation without borrowing Sales credentials or adding a fifth policy. Revenue's minimal proposal is a separately mutable, bounded owner-assessment response header on the existing exact compensation/finalization POST: Scheduling-Compensation-Current-Assessment, canonical JSON encoded as unpadded base64url, maximum 8192 ASCII bytes, no-store, duplicate physical header rejected. Its body/result receipt remains unchanged and hashed over original saved bytes. Revenue sends its retained exact finalization command under fresh compensation-scope authentication; verified completed journal replay does not rerun effects, while Delivery coherently observes the original referenced resources for the header after current exact authorization. The assessment binds association, compensation, AuthorityRef, writeback ID/digest, finalization ID/raw-body hash, monotonic current protection/resource facts and observation digest. It reports original resources un-reassigned, no contradiction/unresolved original work and exact retired g+2; otherwise omit executable positive evidence and return pending projection. A missing/invalid/oversize header yields pending, never inferred retirement. This is a proposed transport amendment for Platform005/Delivery/Sales review, not authority already in PR head. An equivalent bounded mutable envelope sibling is acceptable if immutable original response bytes/hash are separately retained and its wire is specified explicitly. The final chosen transport and schemas must be assembled before Revenue's exact-package acknowledgment.

Compatibility consequence: required sibling changes only proposed ordering3 recovery, and the Delivery observation transport changes only proposed compensation1; neither has an accepted caller to retrofit. Keep v2 responses and all original immutable receipt bodies untouched. This transport does not change the four policy count or add a third command operation. Include vectors for lost finalization response, changed current resources after historical success, missing/stale/foreign observation, contradictory facts and pending dependency, proving Sales stays blocked in each negative case. This is the only remaining Revenue design blocker; future DB/crypto/race proof does not replace this schema/transport decision.

Verification and publication boundary

Independent report C:/Users/jallr/.codex/worktrees/revenue-adr0052/revenue/.tmp/adr0053-revenue004-review/review-report.json, SHA256 0c1a5cc62e37921f41ee7f9a964eeaf80af2d5939d3c4fb723d3a40751c4079e: 123 checks passed, including exact 44 PR blobs, package pins and required observer/event fields. The copied portable full-linkage runner passes all 13 semantic cases. Proposed obligation schema compiles and four closed/pending-negative checks pass; its report SHA256 is d826efe93e4913c642895cbfce9d3900bc58b513a7f6d3bada140be742e28008. These are offline design checks only, with no signature, DB, provider, actual ingress, concurrency or production assertion.

Live ledger discovery at 2026-10-03T02:38:49.246Z found no relevant pending/working/conditional ADR-0053 entry to complete. Revenue candidate remains clean at d24da76a84e7fc72dc909a1d84c748e9d11d8d65, existing fixtures and earlier scratch are preserved, and no runtime, DB, provider, key, deployment or activation changed. Root alone publishes this memo/proposed schema and performs canonical index/freshness checks. Please incorporate the selected version/migration decisions and explicit observer transport, then return the next exact head for a focused formal acknowledgment review.