ADR-0049 paid-invoice handoff readiness decision
Sales clears paid-invoice-handoff-ready after accepting the cross-domain implementation, guarded cancellation compatibility, isolated end-to-end evidence, and actual deployed authentication and scoped assessment checks. This authorizes the coordinated admission release with automatic reconciliation disabled. It does not claim a paid production customer transfer.
Evidence
Revenue corrected source 5417af4cf384ecc91f8a1da7a671a4094993ee05 is canonical on dpl_DjpzM72TiEFko4BUBXFmjDG19rTJ. Its owner verified the guarded migrations, ordinary-writer compatibility, turnover, immutable source, and enabled payment assessment. Delivery's active consumer is dpl_7d4kFJiqwn5nxo6C35iS2bT7jkDL, with the actual production signing binding verified. Prior isolated tests prove exact customer, organization/market ownership, preparation, retry, and later-lock behavior; transport acknowledgment alone does not establish a production transfer.
Platform's Render deployment dep-db05l8jm8hqs73cq01i0 became Live at 2026-10-03T01:31:49Z, October 2 in Central time, on source 3909dacbdd9070b365f593c6b898c2d8704c0f7b. The coordinator confirmed fanout and external-action runner startup. Application, worker, dependency and migration bytes match reviewed source 195a9f4; subsequent differences concern CI setup and tests. Platform's canonical Vercel release and reporting mappings are verified. The preactivation Sales transport inventory had zero handoff events, backlog and dead letters.
Sales' actual protected Node workload used its normal Vercel OIDC exchange and Revenue endpoint at 2026-10-03T01:23:03.990Z through 01:23:07.332Z. Correlation 9ee2a32e-ee23-4e5f-a2e9-fca5a2ccb2aa identifies the sanitized diagnostic evidence. Three current invoices returned HTTP 200 with valid assessment schema and matching scope, each deferred as not_fully_paid. The fourth replacement invoice returned HTTP 503. Revenue reproduced the exact tuple read-only and classified it as order_scope_unproven: no reservation/account/market linkage or settlement provenance. This is the required fail-closed negative outcome, not a transport outage or permission to infer scope from unrelated client accounts. Sales must keep it deferred. No timestamp or relationship was fabricated.
The Sales admission candidate is source 091d3c0d41e06bc4a5f476142bdded22d9a2aa49, Ready on dpl_9Vff3ftE5dFCUSFmqFNgDg6LsERD. Its 841 uploaded files match the prepared source, preserving current UI and header fixes. The only release overlay selects Prisma generation and Next build without migration, prompt installation or repair hooks. All four canonical crons remain, and no diagnostic route is included. Immutable build/runtime flags enable admission and disable automatic reconciliation. Promotion requires a fresh current-source check.
Activation and existing clients
The root activation commitment advances from conditional to pending; it is not complete merely because this decision is published. Persist and read back the intended production flags, promote the verified current-source release, and confirm actual canonical aliases and runtime state. Then refresh the read-only inventory. Apply only genuinely eligible current tuples through the normal handoff service, with fresh authoritative assessment and local fence revalidation.
Current evidence identifies three unpaid clients and one client with unproven order scope, zero eligible transfers. Record a zero-apply result if the fresh inventory confirms that disposition. Do not invent a paid production receipt to validate rollout. Any actual transfer must be verified in Sales history and active queues and in Delivery's customer, payment ownership and preparation records. Later refunds or cancellations remain Delivery/Revenue-owned and do not reopen Sales automatically.
Sales operational evidence is retained under sales/.cache/payment-handoff-integration/.tmp/, including probe-v2-runtime-result.json, adr0049-admission-091-ready.md and source manifests. Revenue's .tmp/release49/probe-v2-readonly-proof.json contains the fourth-tuple diagnosis. Platform retains .tmp/adr0049-render-live-proof.txt and the corresponding screenshot. These contain deployment and scoped proof evidence, not permission to publish private client tuples.
Activation and inventory completed
Sales promoted dpl_9Vff3ftE5dFCUSFmqFNgDg6LsERD, source 091d3c0d41e06bc4a5f476142bdded22d9a2aa49, after the fresh canonical source check and readiness publication e9f24e39dab445c0e4e6f3e1b6dfca783006444d. Saved production flags were read back as SALES_PAYMENT_HANDOFF_ENABLED=true and SALES_PAYMENT_HANDOFF_RECONCILIATION_ENABLED=false; the same values were explicitly set on the deployment at build and runtime. The canonical custom domain, project aliases and main-branch alias point to this Ready deployment. All four original crons remain. The root responds with the expected Platform sign-in redirect. No migration, prompt installer or customer communication was run for activation.
The fresh read-only Sales inventory at 2026-10-03T01:35:06.101Z covered 92 active Leads: 88 without an order correlation and four current correlated candidates. All 86 terminal Leads remained excluded. No active candidate had a handoff receipt or payment audit. The exact four current tuples matched the refreshed diagnostic allowlist. Actual workload assessment at 01:35:35.835Z through 01:35:40.567Z, correlation 8f143007-0270-4ac1-b162-3a47d79e1187, again returned three valid unpaid assessments and the fourth fail-closed HTTP 503, consistent with Revenue's authoritative order_scope_unproven diagnosis. No candidate was eligible; zero apply operations were performed. No paid production receipt or Delivery transfer is claimed.
The retained diagnostic dpl_EhtqDTFopM4zdumJ5wCa7RJ8oMeb was removed only after proof and diagnosis completed, with sanitized evidence retained. The activation and reviewed existing-client disposition are complete. Automatic reconciliation remains disabled; future eligible payments use the normal admitted handoff service, and production Delivery rows must be verified for actual transfers. The unproven order remains deferred and is not repaired or reassigned by this rollout.