Sales final-source closure recovery and four-case isolated evidence

Sales completed the authorized four-case isolated resume under assignment ADR-0050/sales/005, coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc, host local. This owner-authored memo is prepared for root review and publication. It records Sales evidence under accepted ADR-0050, without activating production, changing producer contracts, or closing the broader ADR-0048 production commitment. Delivery and Revenue independent postrun checks were dispatched by root and are not claimed as completed here.

Exact sources and isolation

The resumed Sales source is 2652c11ea33175dadb9e25f354d8b58cd50c3004, on the clean isolated checkout C:/Users/jallr/Documents/Sguild/repos/sales/.cache/onboarding-reevaluation. It follows preserved source 756f5d5b4a0056b5bcb12b4c3af150f0b7ff89cd, reconciled with released Sales 091d3c0d41e06bc4a5f476142bdded22d9a2aa49. Recovery edits do not change that released UI.

Delivery ran 8095b96d315405a1b41936c2eb718084085195e0 on loopback port 3492. Revenue ran 689e8b96f415d0beb1d00e6003595b4d0fbca8c2 on loopback port 3591. The isolated signer remained on port 3581, JWKS byte SHA-256 436920e8ed00a618bf512eec563cc5b8d2350c59d961fb0313e4f6bacf258089, with fresh scoped synthetic authentication. The earlier producer listeners on 3487/3587 were excluded. Database access was restricted to the named isolated fixture databases on loopback 55434, with pinned observer roles for snapshots. Provider behavior was a local double; fanout, shared mesh and external providers remained outside this run.

Preserved failure and consumer correction

The first final-source run stopped after Delivery rejected a new Sales abort with abort_already_in_progress. Delivery already held completed predecessor abort c2220246-00ec-421b-8bf8-808d7dd90970. Sales saved rejected abort cc328bbf-69aa-4978-9dcd-8d8875235b12 instead of discovering that exact existing settlement. The first run made no child POST and left Sales onboarded, closure pending and outreach paused. Its evidence and all-domain failure snapshots remain unchanged.

Commit 2652c11 corrects this Sales recovery gap through the accepted exact OperationRead abort_id, followed by that exact AbortRead. It validates the original request/fingerprint, selected head, tenant/person/organization/closure/lesson, retired state, local settlement identity and full Revenue admitted-noncommit or never-admitted proof. The preview boolean is not sufficient. Sales separately appends immutable recoveredSettlement and abortRejection provenance with audit events. It does not replace the old abort command, its body/fingerprint, or allocated child/release IDs. A permanent abort rejection without recoverable settlement becomes terminal rejected; missing or malformed evidence cannot complete Lost. Fresh head and financial eligibility are rechecked before child preparation.

For the first saved decision 14339a98-509c-488e-b0b4-fcd185cd3395, resumed child 76702af9-1e4f-4198-93a7-9f2f5ea00693 and release a2ce9fd4-5fc8-424b-90f3-5ed2b8ad7117 exactly match the failed run's allocations. The rejected abort remains recorded alongside the recovered original abort. No fixture reset, journal rewrite or replacement decision was performed.

Migration and local checks

Under a separate migration-only grant, Sales applied 20261002220000_onboarding_reevaluation_recovery_guard/migration.sql once to database adr0050_final_03a0388fca484a268c7baa70368d6118, schema sales. The SQL SHA-256 is 64e160a63dfc99a6f80aa4800e42c16345795c7d6eedb2e89115b7e8a07fdb0b. Database, session and function owner were verified as postgres before execution. Only pg_proc.prosrc for sales.guard_onboarding_reevaluation_journal() changed. Function identity, privileges and all other captured schema catalog objects remained unchanged. All 48 Sales, 57 Delivery and 53 Revenue table hashes still matched the failure baseline, with no new migration/journal row. The prior function definition and exact before/after catalogs are retained.

The initial verifier stopped after saving all snapshots because it compared a numeric function OID with the text representation in catalog JSON. Offline verification normalized that identifier and passed. The original verification failure is retained; SQL was not rerun.

Validation passed 229 closure tests, 12 authorization/denial harness tests, type checking and an isolated cadence drift check. Nine opt-in PostgreSQL tests were skipped by the ordinary closure suite; five reevaluation PostgreSQL tests were separately run and passed in a newly allocated isolated database. These prove actual append-only SQL protection, duplicate decisions, interruption recovery and pending-closure admission/handoff exclusion. Unit cases cover soft and held existing settlements, both upstream proof variants, wrong bindings/fingerprints/abort links, malformed proof, funded or changed-head blocking, permanent rejection and response loss. These checks are distinct from the real composed producer run below.

The separate fresh PostgreSQL and cadence proof is retained at C:/Users/jallr/Documents/Sguild/repos/sales/.cache/onboarding-reevaluation/.tmp/sales_handoff_race_c6dec8a6ea404834897fd06efd186492.json, SHA-256 96bd75c5465b4fc4b2754fd2217aa846e1bf17481c85dbbb754066cdf20358290. Its base commit is the pre-change pin, with exact tested working-source hashes recorded in the artifact; it is not relabeled as a post-commit rerun.

Bounded resumed results

Root granted exactly one ADR-0050/final-composed-resume-001 execution after migration and producer readiness. The separate resume-closure-final.ts runner verified the new grant, source pins, original evidence hashes, existing first-attempt hash, installed guard body and all failure-baseline table hashes before business execution. The root manifest raw SHA-256 is 41c70820b8a03f4e2a5cb64a7d52d234e573502ab4b7108d6a997e8496541b84, canonical hash b62bc57301c00391ac56145aa8ffe29e65460efa6568331c656a247895e940f1; approval raw SHA-256 is 9bc4ba475af01019d8e6421c7ceeb037475dcb2932ad797d56e2cef30e2e75d8.

Each successful case has a Canceled lesson at outcome version 1, released lock at version 2 and RELEASED reservation at revision 1. Each has one Lost stage-history row and one lead.stage.changed event associated with that lead; replay preserved these counts. No ledger reversal was created by the reservation release receipts. Across the resume there were three Delivery child POSTs, zero Delivery abort POSTs and 54 recorded calls. The snapshots cover 158 tables (48 + 57 + 53). Root confirmed that the earlier statement of 160 was arithmetic error, not omitted coverage.

Whole-run snapshots show Sales stage-history rows 0 to 3 and total Sales dispatcher rows 0 to 6, of which the three named lead-stage events were checked. Delivery operation rows advanced 3 to 6 and dispatcher rows 0 to 3. Revenue operation rows advanced 3 to 6 and dispatcher rows 3 to 6. Exact changed-table counts and hashes are in the result summary. This whole-run mutation set is separate from the zero-effect denial and no-order producer comparisons.

Evidence inventory and limits

Artifacts below are retained under C:/Users/jallr/Documents/Sguild/repos/sales/.cache/onboarding-reevaluation/.tmp/adr0050_final_03a0388fca484a268c7baa70368d6118/. Local artifacts are not represented as remotely published evidence; root should preserve them with its acceptance packet.

Invoices were already canceled in the prepared fixtures and were authoritatively verified; the resumed run did not newly cancel those invoices. The no-order positive ownership problem remains unsupported. No refund, paid-policy override, full production migration history, production authentication, external-provider execution, downstream fanout, deployment or activation is proved here. Table hashes and recorded calls do not establish the absence of every possible unrecorded network attempt. Independent producer postrun acceptance remains separate. ADR-0052 and ADR-0053 work are outside this evidence.

Ledger and publication handoff

Sales checked the live ledger generated 2026-10-03T02:29:00.565Z (October 2 local date) and the Sales ADR-0050 source memos. No separately declared local ADR-0050 commitment was found to mark completed; those source memos have commitments: []. No ledger status change is proposed.

The broader entry 2026-09-26-sales-guarded-onboarding-lost-closure::0 remains exactly |working|P1|M|Integrate accepted guarded producer cancellation interfaces and verify unpaid closure with payment-race and recovery evidence before production activation. This memo does not close it. Root reviews and publishes this evidence, obtains independent owner acceptance and runs canonical indexing/freshness after publication. Sales performs read-only corpus validation only for this draft, preserving root's sole-publisher boundary.