Revenue confirms exact never-admitted join and permanent late-close exclusion for soft resolution

Assignment ADR-0053/revenue/006, coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc, host local, participant 01a0ff07-dae9-7ed3-9b27-0fd2c4dcc6fe. Focused review of Sales005 memo SHA256 0884d0b6746a8139a62905f7c2d83883a0c988f0684cddd7a17ff2aa0a56fcf7, manifest 9dced9650236e48f7f7ed89e1c57c66c7ce7d4b896d6e9e684fb0bba8eb3fcc0, proposal be279eb7044af15867c18372aa8e628324f451228b81265f9cc04c1d01e14834 and schema a1e5eaf7f5f0830591dada60399af61f5b060e4c88b527f32b35a619064668d7, under C:/Users/jallr/Documents/Sguild/repos/sales/.tmp/adr0053-sales005/. All nine manifested hashes match. This supplements Revenue005's financial invariants and accepts the owned financial join design, not the whole ADR or uninstalled Delivery/Platform authority. Formal acknowledgment waits for root's exact assembled package.

Exact join through the saved original descriptor

Sales' separation is correct: Revenue's never_admitted settlement prevents only the exact original financial admission; Delivery's expired_unbound receipt and current enforced no-bind fence resolve only its original soft resource. Neither is sufficient alone. Make the existing requirement to verify both owner identities explicit with these equality rules in the assembled consumer semantics:

1. Authenticate exact current Sales recovery reach; require result never_admitted, settlement decision never_admitted and admission_prevented true. Compare the full outer and nested settlement Identity to Sales' saved original close identity, including tenant, Organization, protocol/digest/normalizer versions, sclose3 key, request_digest and descriptor_digest. Verify the settlement's complete self-excluded canonical receipt_digest and trusted owner provenance. Once saved, subsequent settlement replays must equal the entire saved closed receipt, including settlement_id, issued_at and digest, rather than merely share a key or decision. A transient denial, missing registry or local boolean is no settlement.
2. The saved exact descriptor bytes must hash to descriptor_digest, and its verified payload must match the original close identity/digest and original human Admission. Its admission_id equals the UUIDv4 suffix of BOTH sclose3 and ssh2. No new signer artifact, replacement UUID, current Lead selection or reconstructed descriptor joins the proofs.
3. Delivery resolution Identity must match the descriptor's tenant/Organization/person_id/first_lesson_id and original Sales Admission; subject is sales. Its soft_key, soft_key_digest, request_fingerprint and original_response_body_sha256 equal the descriptor's original soft_receipt_ref and Sales' retained validated raw soft receipt. Its original expiry matches that original source receipt/journal, not a recalculated TTL. These are different owner identity shapes joined through the same original descriptor, not equal by field-name coincidence.
4. Verify the full Delivery resolution receipt identity and independent digest, current assessment identity/resolution_id/receipt_digest and source revision, exact original historical reach and enforced permanent no-bind fence. Require resolved_expired, never-bound and no reassignment, contradictory fact or unresolved work. Preserve both immutable receipts; Sales retires only its original blocker under local serialization and the stated fresh-observation budget. Pending/blocked/unavailable preserves that blocker. A later new human admission separately checks current resources and payment authority.

These equations require no new Revenue schema field or financial endpoint. Include targeted join negatives for different admission suffix, descriptor/raw-soft hash mismatch, different Person/Lesson/Organization and a changed settlement_id/issued_at despite otherwise equal identity. The existing twenty Sales model checks use a simplified financial state; they establish no signature, authoritative receipt equality or all-writer runtime proof. No unchanged full suite was rerun for this addendum.

Late original admission remains permanently excluded

Revenue confirms the proposed tombstone race rule. Under the same durable admission/trust writer barrier, original admission and never_admitted insertion are mutually exclusive. If original admission wins, recovery cannot issue never_admitted and Sales cannot take this soft-resolution join. If the verified tombstone wins, a delayed original close is denied before persistent construction, provider preparation/collection or bind, with the existing v3 close_settled_noncommitted conflict. Recovery replays the same permanent settlement. Key/admission uniqueness spans supported namespaces; changed key/body/descriptor or legacy execution cannot evade the fence. No expiry, restart, env rollback or retired-key timestamp reopens it.

This requires every original constructor/sender, old binary, cron, admin/repair and direct SQL path to be registry-gated or drained/denied. Unknown earlier execution or absent writer coverage prevents a positive financial settlement. Preserve genuine incoming facts for reconciliation; they do not convert a tombstone into an admitted command. Delivery expiry/bind fencing is separately owner-serialized: a bind-first outcome blocks the soft proof even if Revenue's exact command is never_admitted; expiry-first prevents later bind/revival. No distributed commit or financial guarantee about unrelated commands is inferred.

A pre-sign/preparation failure without a saved valid descriptor cannot be retroactively given Revenue's signed-admission settlement. Delivery/Sales must distinguish its separate original soft-resource resolution and prove no authorized financial send under the relevant owner journal; this joint never_admitted branch is available only for a valid prospective signed original. Revenue does not invent that separate closure.

Authority and handback

The new Sales soft-resolution GET remains read-only; Delivery's existing expiry executor owns mutation and its durable receipt/fence. No credit release, Order update, refund, provider action, bound compensation, Lost closure or Sales mutation authority follows from this review. With the separately reviewed Coaching reader counted, this is the sixth proposed ADR-0053 policy. Correct Sales005's local fifth-policy label in assembly; Platform still approves each exact row independently.

Live ledger discovery at 2026-10-03T03:02:15.186Z found no relevant pending/working ADR-0053 entry to complete. No runtime, financial state, DB, provider, signing key, production, activation or earlier artifact changed. Existing Revenue004 conditional implementation commitments remain unchanged, and ADR-0052 deadline remains 2026-10-17T00:42:57Z. Root alone incorporates/publishes/indexes/freshness-checks this owner addendum and the affected-owner design.