Sales acknowledges exact ADR0054 assembled design head8dc1f75

Sales approves the assembled design at exact draft PR5 head 8dc1f75dd4aaeb586df7ca6bfa4bf5a351efed39, all26 changed files, and acknowledges ADR-0054 for that head. This acknowledgment is a design decision, not runtime implementation, production authority, deployment or release readiness. No blocking Sales correction remains at this head. Coordinator01a0e095-f279-7fd0-a8ef-92ce8f9547fc/local remains sole canonical publisher/indexer.

All26 exact Git blob snapshots match the supplied overlay-map.json SHA256 8e67831a565ffc2f8c992a134b4c30392024b46c0deed0b4d2b25a348e7c0793. Source manifest in this folder pins every file. I reproduced the exact portable validator's36 offline checks using Ajv8.20.0 and ajv-formats3.0.1. Sales'30 full Delivery-response/hash comparison vectors also pass against this head's actual closed soft-resolution2.0 schema. Those tests prove closed grammar, version/ownership boundaries, immutable definitions and pure comparison behavior; they do not prove actual signed route/issuer, financial settlement, request order, transaction, latency or producer source provenance.

Scheduling4.0.0 and Ordering4.0.0 correctly version mandatory consumer changes, with CreditReservationLock3.7.0 and ServiceAuth1.10.0 and unchanged Identity2.0/global event grammar. The sole existing Sales soft-resolution scope and endpoint stay narrow. The request and response require exactly one Scheduling-Soft-Resolution-Observation-Version: 2.0, outer2.0 and CurrentAssessment2.0 with required assessment_revision_scope: delivery_protected_source covered by its complete DigestInput. Old/missing/unknown/repeated negotiation cannot silently fall back. Immutable ResolutionReceipt, terminal fence, original raw201 command/result and their1.0 definitions remain unchanged. The old pinned observer grants no positive current retirement after coordinated cutover. Original close/descriptor/bind and bound finalization wire are unchanged.

Sales accepts strict ordered D1 -> fresh independently verified Revenue never-admitted proof -> D2, all within one monotonic10000ms attempt, with independently fresh scoped authority and Platform historical resource access for each Delivery read. Validate each full identity/receipt/fence/assessment digest independently, then require equal local revision, complete stable local predicate projection and seven semantic resource fields. Different observation metadata may legitimately change the full digest. A compatible local increase or changed remote semantics denies this attempt and may refresh the same immutable original outside locks. Regression, overflow or equal-revision LOCAL predicate divergence is a retained producer clock fault requiring owner correction; a subsequent stable pair cannot wash it away. No cached response, promise, bearer or previous-attempt positive comparison qualifies.

The descriptorless branch is now concretely compatible: it requires the same explicit versioned fresh pair and complete original resource/receipt/fence checks, plus the authentic separately accepted permanent Sales zero-authorized-send fence under common serialization. The fence must establish zero prior authorized original ordering-send/signature/history and irreversibly deny future original sends. Missing original raw201 or missing authentic zero-send evidence leaves closeout unresolved. This remains distinct preparation-failure closeout, never financial never-admitted settlement, Revenue tombstone, paid/booking success or authority to fabricate a descriptor/admission. No financial proof is invented or removed from the signed branch.

The extra Delivery read and fresh scoped issuance are feasible as a bounded fail-closed design, subject to real latency and concurrency evidence. The first timed request starts Sales' total budget, all later mints/reads/parsing/lock waits/CAS/commit use only its remainder, and each Delivery request separately enforces its own budget. No owner HTTP occurs under Sales locks; SQL/lock/transaction timeouts and final checks must make an expired protected write roll back. Slow or unavailable paths retain truthful pending status, never extend the10000ms budget. Remote ABA and post-D2 change remain the explicitly accepted bounded residual model, not a lease, all-source clock or exact-instant distributed fence. Coaching's complete protected-set semantics and every permanent fence remain unchanged.

The one new original-bind association read is Revenue-to-Delivery only. Exact selectors, dedicated audited issuance and historical access precede bounded closed receipt disclosure. Prospective complete original capture is atomic with first bind receipt/event/protected continuation; missing historical versions remain ineligible without backfill. Revenue's immutable original bind-context quantity remains the fifth financial field, with lossless positive original/current/Authority equality and full Authority/digest inclusion. SQLNULL optional Delivery mirror stays NULL; non-null invalid/conflicting quantity remains a contradiction at every named effect/observer/deferred check. Exact originally issued/consumed AuthorizedEvidence bytes and their raw SHA256 remain retained independently of regenerated current observations.

All three compensation events use the verified original successful ReceiptRef.event_id as common causal correlation with distinct event_ids, unchanged registered payloads, atomic once-only outboxes and immutable replay. Sales' existing credit.released join remains tenant/reservation-based and records source event_id; shared correlation cannot become a dedup key, financial authority or protection-clearing signal. Complete actual producer/dispatcher/consumer proofs remain necessary. Existing reservation-first, composite/atomic multi-lesson, reschedule, trial, existing invoice and add-on/top-up requirements continue under accepted human/owner authority.

After acceptance and explicit coordinator handback, Sales' remaining implementation must install the2.0 adapter, ordered same-attempt financial/resource join and distinct no-send pair; retain source-clock faults; enforce remaining-budget transport/SQL behavior; and prove actual issuer/owner auth, receipt custody, CAS/races, provider and supported-flow behavior before activation. ADR-0053 candidate source remains clean and unchanged at eaae89ba0d18dcf468d1009fd45aec0b1a8a7b21. Its existing outstanding tests, migration/role/writer inventory, custody/entropy and release gates remain open. No code edits are authorized by this design acknowledgment alone.

ADR-0052 deadline remains2026-10-17T00:42:57Z, ADR-0053 maximum remains2026-10-17T03:32:35Z. This correction does not restart either deadline, expire a fence, regenerate history or enable new admission. Sales holds for the coordinator's acceptance/publication and explicit handback to unfinished ADR-0053/sales/007.