Sales resolves owned design choices and requires exact original-obligation assessment transport

Assignment ADR-0053/sales/004; participant 01a0ff07-d3d4-7553-bf28-5314810de63e, host local; coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc, host local. Reviewed proposed PR 4 at exact head af45908fc13ce698097e6ff6dbde66bbdb37bc4b. Remote pull head matches. Source manifest SHA256 2df1abfe3d5cef3e62f0bd1b69107705daa45779978e44c78f13a1a5e3092953, file-map 624da6a1d13c5c324ee53f403a3c3fc48d97f1f77e950cb8a0c59afdbafd6bcf; all source artifacts matched hashes/lengths, and all 44 mapped files byte-match Git objects at that head. No assumption about a moving PR is used.

Sales accepts the resolved identity, descriptor, normalization, authority separation and compensation direction as design choices below. One genuine design blocker remains: the mandatory Sales retirement evidence has no Sales-readable producer transport in the closed package. Formal acknowledgment is withheld only for this gap, which the coordinator independently confirmed and routed to Platform005/Revenue004/Delivery003. Future signer/DB/provider/production proof is implementation work and is not the reason for withholding. This memo has no acknowledges field and accepts neither another owner's position nor activation.

Exact failing clauses and bounded replacement

contracts/sales-ordering-surface/original-close-recovery.md section 5 and $defs/RecoveryResponse permit only original terminal identity/response, pending identity/reason/time, or never-admitted identity/receipt, with additional members forbidden. contracts/sales-scheduling-surface/scheduling-bind-compensation.md limits compensation evidence GET to Delivery and compensation/finalization POST to Revenue. Yet the incorporated Sales position requires exact writeback plus finalization g+2/current original-resource evidence before retiring a failed-close blocker. The new operational/financial events carry neither the full protected finalization proof nor a coherent current assessment. Sales cannot borrow those policies, guess from absence or keep a permanently blocked completed compensation as fulfillment.

Actual Sales code confirms the need: lib/revenue/sales-ordering-close-client.ts parses only the existing flat original success; scheduling-admission/repo.ts:82 completes only reserved/committed with an Order; lib/delivery/lesson-hold-client.ts:213 uses the old session read and modules/scheduling/scheduling.schema.ts:99 returns ordinary lock/resource fields, with no compensation/finalization proof or protected-phase observer. handleCreditReleased records reason metadata but its helpers classify only system_unpaid; proposed system_other/failed_close_compensation becomes generic cancelled/other/lesson_scheduled presentation and paused cadence. It does not complete the scheduling journal/task. A frontend adapter alone cannot supply the absent owner evidence.

Minimum replacement: add a separately versioned closed original_obligation_assessment sibling to the existing exact close-recovery assessment, preserving immutable original_response/settlement bytes and original identity/digests. The current Sales recovery scope reads only the retained original command's correlated owner evidence, with no fifth policy or Sales mutation. Explicit unresolved reasons retain the blocker. Resolved admitted-failure assessment requires exact Revenue irreversible writeback/no-new-collection/all-work-resolved proof plus Delivery retained g+2 finalization and separate coherent current original-obligation source assessment. Never-admitted financial settlement also needs exact Delivery-owned unbound soft resolution, not TTL/404 inference or bound compensation. Producer owners must identify their actual authorized proof acquisition, storage and current-read paths.

Detailed replacement text and required correlation/denial/version semantics are in C:/Users/jallr/Documents/Sguild/repos/sales/.tmp/adr0053-sales004/consumer-assessment-requirements.md. This is a reviewable bounded amendment, not an open placeholder schema or a proposed Sales cancellation capability. Required member addition before recovery 1.0.0 acceptance changes only this proposed schema; after acceptance it would require explicit recovery compatibility/version migration. The original ordering v2.9 wire and v3 flat terminal result remain unchanged. Root must collect the producer-owned closed correction before formal Sales acknowledgment.

Revenue004 subsequently supplied closed candidate original-obligation-assessment.proposed.schema.json, SHA256 76023ab1c459c16e894408b89e8d7a4e7bb4cadda9c60fb12e0b2ed8d8238ea4, outside the reviewed PR head. Sales supports its required original_terminal.obligation_assessment direction: active/pending retirement_eligible false, and retired_compensation carrying exact WritebackProof, FinalizationResult/raw-body hash and a distinct current Delivery observation. Its false contradiction/unresolved/reassignment assertions and retired phase must come from coherent owner rows with revisions advanced by all relevant writers, not merely shape-valid constants. Every repeated identity/association/authority/key/generation/hash must match; current assessment digest preimage and source revisions require explicit semantic vectors. Require pending rather than a fabricated positive observation on authority, proof or dependency failure.

For Revenue's acquisition from Delivery, Sales prefers the straightforward closed JSON envelope: exact original immutable finalization response bytes retained separately (base64 plus SHA256 and typed validation), with a separately mutable current original-resource assessment sibling. A bounded base64url header is not selected by Sales. Revenue replays only its retained exact finalization command under its existing fresh compensation scope, never a new mutation command for lookup; Delivery must authenticate/correlate, replay the immutable outcome and coherently assess original resources outside mutation effects. This is a producer-owned amendment to the still-Proposed compensation response, not a third operation/fifth policy. Current failure must not erase original terminal truth. Assessment is an observation rather than a new admission lease, and late genuine facts may block replacement without rewriting historical finalization. The never-admitted branch still requires an explicit Delivery-owned original soft resolution path before claiming automated blocker retirement; the financial tombstone alone cannot supply it. This concrete candidate is suitable for the correction review, but it is not in head af45908 and cannot justify acknowledgment of that exact head.

Concrete Sales-owned design choices

Identity and freshness. Sales accepts a fresh exact Person/Organization verdict snapshot per relevant business attempt, outside local locks, as the stated distributed observation. It does not claim cross-domain commit-time activity or a lease and requires no new identity fence for this bounded design. Fresh local sender/resource checks and later admissions remain mandatory. Mutable Lead/display references may follow verified canonical lineage; immutable original UUID, Person, actor, commands/digests/descriptors/receipt bytes remain original. Current service reach plus retained exact owner association governs historical disclosure; archived/paused/merged history is not a new booking and missing lineage is pending. Sales selects Identity 2.0.0 for the explicit exception to 1.5 section 9.5's required historical re-key obligation, even though Person-by-id wire remains unchanged and ADR-0052 already protects its immutable journals. A changed required consumer obligation deserves explicit migration rather than an unconditional 1.6 minor claim. The package currently conditions that version choice; this is Sales' concrete owner disposition.

Versions and authority. Sales accepts explicit ordering 3.0.0 for mandatory protocol header, original UUIDv4-based key and descriptor plus integer raw tightening; no old key/receipt backfill or v2 normalization rewrite. Recovery/descriptor/compensation sub-specs 1.0.0 are separately gated new interfaces. Service-auth 1.9.0 adds exactly four policies; original seven-scope Sales close authority remains separate from sole recovery scope. The assembled layered 400/401/403/409/503 taxonomy and nullable non-conflict reason resolve the prior classification objection.

For scheduling parent compatibility, Sales requires an explicit major when the protected/compensating exception changes existing required duties that Canceled/released means slot/replacement availability or generic event retirement. Its operator/read/consumer migration is required rather than an unconditional 2.1 minor claim. The PR already conditions that version choice; Sales' preference is a scheduling 3.0.0 migration for affected consumers, retaining original v2 historical wire/receipt behavior and ordinary cancel/refund authority. Credit reason wire addition remains credit.released@2; Sales' string reason handling is wire-compatible, but the semantic presentation/retirement adapter is required. Credit parent 3.6.0 is acceptable from Sales' consumption perspective if ordinary financial release truth remains unchanged and new protected compensation semantics stay in the dedicated sub-spec/ADR-0006 amendment. No approval of Revenue's private financial transition is implied.

Signer and storage. Sales chooses a dedicated server-only RSA descriptor key, never Platform JWT key, with static approved Revenue public trust and permanent non-reassigned kid. A private internal signer may load only an already durably admitted and finalized original record, not request-supplied claims. Its permission boundary is exact original admission/preparation equality plus current approved signer configuration. Persist one immutable prepared record UNIQUE(original admission), same sclose3/ssh2 suffix, exact shared digest and original raw soft-receipt reference. Sign once, atomically save exact compact bytes/hash and audit before original fetch; competing calls return retained bytes. Private key custody uses Sales' server secret boundary, separate from operator/browser access and journals. No signing endpoint, extra token policy, cookie/bearer persistence or provider-token reconstruction is selected.

Sales' internal human-evidence representation will use the complete original accepted scheduling Admission record, unchanged, validated by its pinned closed schema, and a versioned domain-separated canonical envelope: domain sguild.sales-ordering.human-admission, evidence_version 1.0, admission equal to that retained record. Apply the agreed canonical scalar serializer and SHA256, retain source evidence/precision, and convert descriptor timestamps by floor(milliseconds/1000). This hash asserts Sales' durable admission provenance, not an independently observed human/provider event. It contains only approved non-secret authority evidence. No historical journal is retroactively signed into prospective eligibility.

Sales accepts the specified inline commitment algorithm for original opaque provider-issued single-use credentials, with domain/version separation and original amount/identity/link association preserved. Input provenance, sufficient unpredictability/non-disclosure and lack of a reusable capability must be verified for each supported capture integration before enablement. Low-entropy human payment identifiers and raw card material are excluded. This is an explicit security release gate on the selected construction, not an unresolved choice of algorithm or proof supplied by a synthetic fixture.

Trust lifecycle. Stage new public trust at Revenue before Sales activates a key; inventory/drain unseen originals before retiring old trust. Active-only unseen admission/tombstone, serialized monotonic revocation and old-config denial are accepted. Ordinary retired trust can inspect/resume independently admitted originals under owner predicates; compromise cannot authorize new preparation/bind/collection. Retain original public keys, descriptors, audit and immutable trust decisions indefinitely for original identity/tombstone reconciliation; compact artifact timestamps never restore authority. Rotate custody/config without resigning an original command. Source-pinned runtime rotation/revocation/rollback proof is a later gate.

Preparation and operator behavior. Sales selects the shared 8192-byte descriptor and 65536-byte UTF-8 envelope budget, exact decoded bounds and pre-serialization safe/nonnegative/no-negative-zero checks. Reserve descriptor envelope budget before soft send and recheck actual final bytes before sign/fetch. Preserve inline, link and no-payment plus equivalent multi-item ordering and original payer snapshots. Preparation/audit/size failure after admission keeps exact original resource/blocker and actionable reason; uncertain payment remains reconciliation pending. Invoice exists versus invoice SMS recorded and current payment/handoff remain separate facts. A resolved observation retires only the exact original blocker under Sales Lead/admission serialization, followed by fresh independent admission checks, never an original-result rewrite or automatic new payment.

Named conditional migrations and implementation gates

The structured commitments above are Sales-owned and gated on accepted ADR-0053. They cover the close orchestration/client, scheduling admission repo/schema/prepared artifact, token/signing boundaries and typed recovery UI; the credit.released/cancellation presentation and exact assessment consumer; and every Sales direct/indirect sender, recovery/admin retry and old deployment privilege path. Install permanent uniqueness/authority/writer barriers before issuance/sends, drain or deny incompatible writers, preserve journals/tombstones/protection on rollback, and source-pin every denial/response-loss/race/audit rollback proof. Existing partial source gates are not runtime certification.

Supported composite multi-lesson, reschedule/rebook, existing-invoice replacement and add-on/top-up invoice creation remain in the cutover coverage inventory; this ADR creates none of their missing authority and cannot remove them. An unaffected supported flow must retain its accepted adapter, while a flow requiring new authority returns a separately bounded design. Candidate activation cannot globally enable a flag that silently denies them. The existing ADR-0052 deadline remains 2026-10-17T00:42:57Z, with no restart or time-based reopening. Any replaced ordering/scheduling wire needs its own explicit at-most-two-week migration publication clock. ADR-0049 production state and current work remain preserved.

Local proof at C:/Users/jallr/Documents/Sguild/repos/sales/.tmp/adr0053-sales004/: exact Git/map/hash verifier, reproduced 104 assembly checks/ten schemas/72 definitions, and thirteen current-evidence semantic cases. All runner writes stay in Sales scratch; dependency-only adaptations are recorded separately. These establish exact reviewed design bytes/schema/model agreement, not signature, handler, SQL, provider or production proof. Root remains sole publisher/indexer/freshness owner. No ADR-0053 runtime, production, provider, database or key operation occurred.

The supplied Revenue004 candidate schema compiles against actual shared dependencies; eight local consumer model checks pass (positive correlated proof, pending, changed original digest, missing writeback/finalization, contradictory fact, stale protection and changed raw-body hash). The observation digest calculation in this consumer probe is explicitly a proposed rule pending producer agreement, not proof that the producer observes those facts. Fresh discovery reads were 2026-10-03T02:44:05.872Z inbox and 2026-10-03T02:44:06.3Z ledger. No prior implementation commitment was completed by this design review.