Revenue accepts retirement observer design and identifies a nested receipt fixture mismatch
Assignment ADR-0053/revenue/005, coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc, host local, participant 01a0ff07-dae9-7ed3-9b27-0fd2c4dcc6fe. Reviewed the Platform005 17-file overlay at C:/Users/jallr/.codex/worktrees/adr0052-service-auth/platform/.tmp/adr0053-platform-005-disposition, baseline PR head af45908fc13ce698097e6ff6dbde66bbdb37bc4b. Manifest SHA256 3486edcd8fa9ca769f9332fb4235d5b8eed9439c1b535d6308d002db97c9aebe, file-map SHA256 10f021924b8ddeacdc97b7f1e17f4b620bfc327d598e961a3c7984ba89da5f9e. Pins, all manifest hashes, all overlay hashes and existing-file baseline hashes match.
Revenue accepts its owned observer amendment design: immutable result_receipt plus separate current/unavailable Delivery observation, required original_terminal.obligation_assessment, full proof preimages and a terminal-only Revenue financial assessment. These choices resolve Revenue004's Sales-facing transport blocker. One supplied positive fixture is inconsistent and must be corrected before the next assembled verification, as detailed below. That is a validation defect, not a new design objection to the specified equality rule. Formal acknowledgment of the whole ADR/package waits for root's corrected assembly and the separately owned soft-resolution and Coaching protection designs. Future implementation and production proof are activation gates, not reasons to withhold acceptance of this owned design amendment.
Accepted producer and consumer semantics
Revenue remains the sole Delivery finalization caller, sending the exact retained FinalizationCommand under fresh current authorization at the existing compensation/finalization POST. Adopt the selected closed JSON envelope with exact saved UTF-8 FinalizationResult bytes/hash and a separate current_assessment. This supersedes Revenue004's response-header suggestion. Do not hash the mutable envelope into a receipt, regenerate original result bytes, or rerun retired g+2 CAS. A successful historical receipt survives an explicit unavailable observation; foreign or undisclosable history still grants no receipt disclosure. The compensation operation's existing result transport stays unchanged.
Approve original-terminal obligation_assessment as a mutable sibling on the existing exact Sales recovery route/scope. Pending assessment can coexist with definitive original terminal truth. Sales receives no compensation/finalization permission and no arbitrary resource selectors. A retired_compensation verdict requires the complete original Authority, original compensation receipt and raw body, exact WritebackProof with both event IDs, retained FinalizationCommand, immutable FinalizationResult receipt and positive current Delivery resource/protection observation. An original success, cancellation event, credit event or never_admitted receipt alone cannot substitute for this chain.
TerminalFinancialAssessment is an appropriate separate read-only owner observation after g+2. Its assessed_operation original_obligation.retirement.observe, eligibility retire and reason exact_retired_writeback grant neither compensation nor finalization again. Revenue must coherently reread original registry/Order/reservation/intent, immutable writeback, retained incoming facts and permanent sender barrier under its common serialization after Delivery HTTP finishes. Require canonical released/pending_funding/abandoned state, no contradictory retained fact or unknown execution/preparation/provider/writeback work, source revisions covering immutable writeback, and the same irreversible barrier across any newer writer epoch. Missing or obsolete barrier yields pending, never a positive retirement assertion.
The Delivery current observation and Revenue terminal observation are separately coherent owner snapshots, not a fictitious distributed transaction. Advance their monotonic assessment revisions for staged facts, reassociation, source changes or barrier changes even if projection is blocked. Hash every closed current observation field except its own digest; hash the outer retired assessment excluding only its digest. Never replace frozen Authority admission values with current revisions. Later genuine contradictory facts remain append-only and affect the next observation, while old successful bytes remain immutable and original collection never reopens.
Check full Association, CompensationIdentity and AuthorityRef equality across all proofs and both current observations; exact reserved claim, original bind and expected versions; every command key digest/fingerprint and Authority/writeback preimage; full receipt equality inside WritebackProof and FinalizationCommand; raw-body hashes and parsed-result equality; g-to-g+1 compensation and g+1-to-g+2 finalization; final observed generation g+2 and exact finalization/writeback IDs. Shape and internally self-consistent hashes do not establish owner provenance. Sales must correlate outer identity with its saved original admission before serializing retirement of only that blocker. It then rechecks resources under a new human admission independently.
Accept 10000ms monotonic request-to-local-protected-decision observation budgets, bounded responses and HTTP outside locks. Each relevant receiver measures its own complete dependency attempt through its local decision; Sales checks its recovery POST through local retirement after locks. An expired attempt discards positive eligibility and refreshes outside locks; no TTL clears durable protection. Clock timestamps are evidence, not leases, and owners accept the bounded concurrent-change window. Old receipt replay survives blocked/unavailable current eligibility. Apply actual UTF-8 limits of 32768 original body, 65536 Delivery envelope and 131072 Sales recovery envelope before admitting/using a response; maxLength is not a byte check.
Accept the resolved Identity2/Scheduling3/Ordering3/Auth1.9/Credit3.6 versions and the exact domain-separated full original Admission evidence envelope. Accept documented effective entropy of at least 128 bits and opaque single-use provider handles as the activation precondition for the unsalted capture commitment. Arbitrary nonempty parser input is not such evidence. If the token family cannot meet that condition, preserve the inline product motion and obtain a separately approved commitment/capture design before enabling it; neither hash length nor synthetic fixtures prove token entropy.
Concrete focused validation finding
Platform005 observer-vectors.json supplied positive has outer compensation_receipt.response_body_sha256 24fb696920bec2c799f3055c3c6660327250f45d9aeebb537ee86f82ef6f9e40, but WritebackProof.compensation_receipt, FinalizationCommand.compensation_receipt and the raw FinalizationResult's compensation_response_body_sha256 retain 240b7c7e32c25b2c5e76c53fd438f69d7e04c61f06328af9a12022a2c597f694. It therefore fails the prose's full nested receipt equality, despite each component's own digest being recomputed. The existing short observer semantic model does not compare all those nested receipts.
Required correction: preserve one actual original compensation body byte sequence and use its hash consistently in the outer receipt, nested writeback receipt, finalization command and retained finalization result. Regenerate synthetic dependent hashes/fingerprints only when constructing a new coherent synthetic fixture. Never repair real immutable history by rewriting a stored receipt or financial proof. Runtime disagreement is pending/reconciliation, not automatic correction.
For this synthetic fixture, the preserved nested hash matches canonical serialization of the compensation result. The independent Revenue scratch fixture uses those canonical raw bytes, the exact nested receipt, and a refreshed outer observation digest. It then passes full immutable/current linkage without changing any Platform file. Strengthen the shared vector runner to compare full receipts and raw hashes across all components and test a mismatch whose mutable current/outer digests have all been refreshed. Also test immutable event/proof changes and source revisions older than writeback. This catches real cross-component contradictions instead of relying on an outdated outer digest to reject every mutation.
Minimum Revenue proof for separately owned unbound-soft resolution
never_admitted remains only an irreversible prevention of Revenue admission for the exact original signed command. Require current workload reach, exact saved descriptor/key/digest/issuer/admission association, valid original prospective provenance and a permanent owner settlement receipt whose identity and self-excluded canonical digest match the retained registry. Under the common admission/trust writer barrier, enforce mutually exclusive admitted versus never_admitted states and uniqueness across supported namespaces before replying. All original constructors, provider/preparation senders, repair/admin/cron and old binaries must be registry-gated or drained/denied. A later exact original POST sees the retained tombstone and cannot mint Order/reservation, prepare a provider request, dispatch collection, bind, or reopen the admission. Unknown prior execution or incomplete writer coverage prevents a positive tombstone.
This proof says nothing about the original unbound Delivery soft hold's current status, expiry sweep, cancellation, slot release or Sales blocker retirement. A 404, TTL, timer, generic canceled row or Revenue's no-Order fact is insufficient. Delivery/Sales must choose exact soft-resource observation and authorized resolution transport tied to original ssh2 admission, Person/Organization/Lesson and retained wire receipt. Revenue can supply or relay only its exact financial admission-prevention receipt; it cannot originate soft cancellation through bound compensation, invent a financial release, refund, closure or Lost authority. Keep the original obligation pending until that separate design supplies owner proof. New original human admission may not bypass it by changing a business key.
A Coaching protection reader or fifth narrowly bounded read policy, if explicitly justified and approved by Platform/Delivery/Coaching, is separate from this financial proof. Revenue does not impose a four-policy cap and does not infer new mutation authority. The Coaching overlay cannot grant Revenue release/refund or make terminal financial evidence out of a Delivery/availability projection.
Evidence and handback
Focused independent script and report are under C:/Users/jallr/.codex/worktrees/revenue-adr0052/revenue/.tmp/adr0053-revenue005-review/. review-report.json SHA256 6df17ee2148cf149e8dd8efc1bcee4a9cb2422d591c5c79c6fd20644cd9c0837, 55 checks passed. The checks deliberately confirm that the supplied positive fails full receipt equality, then validate a separate coherent synthetic positive and reject eight current/frozen mismatches after mutable digests are refreshed. These are offline shape/preimage/linkage checks, not runtime, signatures, DB, providers, races or production evidence. Unchanged full suites were not rerun.
Live ledger discovery at 2026-10-03T02:55:59.553Z found no relevant pending/working ADR-0053 commitment to complete. No implementation, financial state, provider, key, deployment or activation changed; ADR-0052 candidate/fixtures and prior scratch remain preserved. Its deadline remains 2026-10-17T00:42:57Z. Existing Revenue004 conditional implementation commitments remain the owner work plan and are not duplicated here. Root alone incorporates/publishes/indexes/freshness-checks; return the corrected exact assembly for formal package review.