Sales accepts the corrected retirement design subject to vector repair and requests bounded unbound soft resolution
Assignment ADR-0053/sales/005; participant 01a0ff07-d3d4-7553-bf28-5314810de63e, coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc, both local. This is a focused owner disposition for root assembly, not whole-package ADR acknowledgment. Root remains sole publisher, indexer and freshness owner. This memo has no acknowledges field. Coaching's separately owned overlay is not reviewed here.
Reviewed Platform005 source at C:/Users/jallr/.codex/worktrees/adr0052-service-auth/platform/.tmp/adr0053-platform-005-disposition, manifest SHA256 3486edcd8fa9ca769f9332fb4235d5b8eed9439c1b535d6308d002db97c9aebe, file-map SHA256 10f021924b8ddeacdc97b7f1e17f4b620bfc327d598e961a3c7984ba89da5f9e. All 28 manifested artifacts and all 17 mapped overlay files match their hashes; all supplied existing baseline hashes match exact Git objects at prior PR head af45908fc13ce698097e6ff6dbde66bbdb37bc4b. No claim is made about a later moving PR head. Snapshot and focused proof remain in Sales scratch C:/Users/jallr/Documents/Sguild/repos/sales/.tmp/adr0053-sales005.
Corrected retirement observer disposition
Sales accepts the observer transport/state design: original_terminal requires obligation_assessment, while immutable original_response remains unchanged; active/pending never grants retirement. Delivery returns immutable exact UTF-8 FinalizationResult bytes/hash in result_receipt plus a separate current/unavailable assessment. Revenue uses only its retained exact finalization command and existing compensation authority to obtain that observation, returning the complete carried proof through Sales' existing sole recovery scope. No fifth observer read policy or Sales compensation/finalization authority is implied.
The retired_compensation branch carries full Authority, compensation raw receipt and reference, both-event WritebackProof, exact FinalizationCommand, immutable final result and coherent current Delivery/terminal-financial assessments. Every repeated association, original identity, authority, receipt, key/fingerprint/hash, writeback and generation must match and each independent complete preimage must verify. Financial terminal observation is explicitly read-only retire eligibility, not fresh compensate/finalize authorization. Source revisions dominate immutable writeback; the exact permanent sender barrier survives epoch changes. Final generation is compensation g+1 to final g+2, with current Delivery observation at the latter. Original immutable bind provenance remains separately required, never retroactively regenerated.
The explicit ten-second monotonic budget starts before outgoing owner HTTP and includes receiving locks through the local retirement update; refresh occurs outside locks after expiry. This is point-in-time evidence, not a commit fence or new admission lease. All relevant owner/staged-fact writers advance observation revisions, even while conflicting projections are blocked. Full eight-field current original resource verdict and independently verified historical lineage permit original history access without new-write eligibility. Failure/unavailability preserves historical receipt truth and cannot enter the positive retirement branch. The 32768/65536/131072 UTF-8 transport bounds and strict parser rules are normative, not inferred from schema character maxLength. Identity 2.0, Scheduling 3.0, Ordering 3.0, Auth 1.9 and Credit 3.6 resolve Sales' prior version choices. The explicit at-least-128-bit effective entropy gate resolves the provider-handle construction choice; actual provider provenance/security evidence remains a release gate.
One concrete correction is required before this positive validation evidence can be relied on. observer-vectors.json positive.compensation_receipt.response_body_sha256 is 24fb696920bec2c799f3055c3c6660327250f45d9aeebb537ee86f82ef6f9e40, while writeback.compensation_receipt, finalization_command.compensation_receipt and the retained FinalizationResult.compensation_response_body_sha256 all reference 240b7c7e32c25b2c5e76c53fd438f69d7e04c61f06328af9a12022a2c597f694. verify.mjs reserializes fixture.result with JSON.stringify and changes only the outer receipt hash. Its partial semantics omit these comparisons and accept an internally inconsistent positive.
Required repair: retain the exact original compensation response bytes already committed by all carried receipt references, or generate an entirely new coherent synthetic chain and recompute every dependent proof/fingerprint/body hash. Never change an immutable live receipt or reserialize its original bytes. For the supplied synthetic fixture, canonical compact result bytes produce the retained 240b7c... hash; Sales' local corrected vector restores those bytes and the outer receipt reference, then recomputes only its mutable observer digest. Add negative vectors for repeated receipt hash disagreement, all authority/writeback/finalization preimages, exact barrier identity, source revisions and future/stale observation. No normative transport redesign is needed for this correction.
Focused review.mjs completes 79 artifact/baseline/schema/linkage checks, rejects the supplied shape-valid positive, accepts the locally corrected synthetic positive, verifies the carried Authority/writeback/compensation-key/finalization-key/command and assessment digest preimages, and checks twelve targeted negative mutations plus freshness boundaries. Unchanged 415 ordering and thirteen compensation regressions were deliberately not rerun. This proof remains a model, not original bind provenance, trusted signatures, real handlers, SQL races, provider or production proof.
Unbound original soft resource ownership and minimum contract
The never_admitted branch correctly remains a financial-only settlement. Sales owns its immutable admission/ssh2 command, captured original raw receipt and local blocker; Delivery owns the permanent prospective v2 receiver journal, original soft-held Lesson/expiry, all bind/expiry writers and resource-resolution proof. The existing Sales workload permits only soft-create POST. Sales' old session hold-inspect read and ordinary Canceled/TTL/404 facts cannot supply this proof, and Revenue's original financial recovery cannot borrow a Delivery-only scope.
Source confirms the separate obligation. Sales ADR-0052 candidate 62c6c04 scheduling-admission service requires its durable validated original soft receipt before Revenue continuation; repository retains unresolved admission tasks and currently completes only reserved/committed with Order. Read-only Delivery primary HEAD f4d7cde1ec5e6900c2d82ace9e5a1d2661a0c9d2 has unchanged modules/lesson-hold/repo.ts SHA256 5894076175483ec59669cc02fefcee6e0041842d92413903e053a1303b31ee16: soft creation persists finite TTL; bind locks/rechecks pending state and expiry; expiry rechecks under the same Lesson row lock and cancels only an unbound soft-held row. Expired-but-unswept rows may stop blocking availability, but that is not a durable original-resolution receipt. These source reads establish baseline ownership only, not accepted candidate activation or all-writer safety. Sales candidate repository/service hashes are a5d3703c22f9b8eff3741e7ff1d0fee292c62e7514e5f372044695e500ba1b84 and 941c33769fd8f8ec5b9053853b93cbc5dc661bfc2a114bf3f26edaceca721429.
Concrete minimum proposal is one new dedicated Sales-to-Delivery read: policy sales-production-to-delivery-soft-resolution-read-v1, sole scope delivery.scheduling.soft-hold.resolution.read, GET /api/v1/delivery/v1/lesson-holds/soft-resolutions/{admission_id}, exact UUID-v4 deriving only the original ssh2 key, with exactly one organization_id query matching the singleton workload pin. No body, original soft-create business token reuse, listing, cancellation, bind, early release, financial evidence or retrospective admission is authorized. This is explicitly a fifth new ADR-0053 policy requiring Platform approval, unlike the existing-scope compensated observer correction. Delivery's existing finite owner expiry executor supplies the mutation, never the GET. Add atomically retained expired_unbound resolution receipt and permanent no-bind/revival fence to the prospective original journal under every old/new bind/repoint/expiry writer barrier, preserving original create bytes. Root routes the exact owner request and assembles their response rather than absorbing Delivery or Platform implementation in Sales.
Detailed bounded wire, errors/history/freshness, owner expiry scheduling, guard/receipt atomicity and consumer join are in unbound-soft-resolution-proposal.md; the closed candidate is soft-resolution.schema.json. Pending/blocked retain the original blocker and an actionable reason. Owner expiry must have durable retries/backlog escalation and commit a genuine resolution before completion; permanently pending is not fulfillment. If bind wins serialization, expiry cannot produce unbound resolution and Sales cannot retire from financial non-admission. If expiry wins, any late bind/revival is denied by its permanent journal fence. A delayed original close cannot cross Revenue's permanent settlement tombstone. Genuine contradictory facts remain recorded and blocked, never erased. Sales joins BOTH exact owner proofs and a fresh Delivery observation under its local Lead/admission serialization, retiring only the exact original task with a separate append-only outcome. New human replacement checks current active identity/resources/slots independently.
The proposed read schema compiles against the exact prior-head accepted workload/resource definitions, and twenty isolated model/shape checks cover financial-only denial, pre-expiry pending, expiry success/replay, late bind/close exclusion, bind-first and close-first races, rollback, freshness boundary, unchanged original create receipt, closed positive wire, unknown-member/missing-fence denials and unavailable observation preserving historical proof. This is a reviewable consumer proposal, not Delivery acceptance, installed token policy, real DB race or sweep availability proof. Delivery must supply its owner journal/expiry/read disposition, Platform the exact policy/history disposition, and Revenue confirm original tombstone race exclusion before root can assemble this gap. Existing ADR-0052 publication/migration deadline 2026-10-17T00:42:57Z is not restarted or extended.
Fresh inbox/ledger discovery generated at 2026-10-03T02:59:27.028Z and the same UTC minute respectively. This design review completes none of the implementation commitments. No coordination source/index, runtime, production, DB, provider, key or foreign repo was modified. Root publishes this scratch memo and merged owner decisions, then runs the sole index/freshness checks. Whole-package formal Sales acknowledgment awaits that exact assembled package, including separately reviewed Coaching obligations.