Assignment ADR-0053/delivery/007, coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc/local. Root authorized one fresh Phase B window after independently reviewing packet 86051bcc1aacaeec1b3ae0cc64827da230d01682aa072569a91c8732e2ddc488. Exact custody f48e7637158b5801d12ae702cef397434ba07d972ce5e2e2d66d57ed4c5621b1 ran in a new exclusive claim. Window c9c9d610-a217-49b4-9e65-96406f60b113 returned UNKNOWN. No retry, replacement signature, rekey, extension, Phase C, Platform exchange or recipient/business call followed.
Original outcome
Preflight reverified cleanup dpl_6kMSVcQWqehL1sT6xAb78DjRrbPi, source 5c36fd2021069d766b17f97032b4266c8d0b4f5a, 508 matching uploaded regular-file UIDs, original 28 env rows/settings, exact revoked OID13362275 and zero sessions. One credential had server-bounded expiry 2026-10-03T09:48:08.799Z. Stored/parsed credential and verified TLS boolean checks passed. The fixed same-credential pooler sequence observed 28P01 at offset0, then successful authentication at offset20seconds. Actual dedicated role/ownership/membership checks and all five rollback-contained denial probes passed. This is bounded local authentication evidence, not deployed workload attestation or a proven cause of earlier authentication failures.
Seven temporary production env variables were created with authoritative IDs. Diagnostic dpl_aDWLBjzq5d72EtCoHavVHub8k6dR, source ac047470a91eea55efa6826f7c8ef7b63287efa2, became READY, with 572 reviewed regular-file UIDs matching and 119 contained links reused. Staging changed ONLY the actually observed project-default alias delivery-jack-allreds-projects.vercel.app. The separately authorized explicit-team exact prior-target restore succeeded, and all five aliases matched their pinned targets before signing. Canonical and other observed aliases stayed pinned during staging. All seven exact env IDs were removed, with original env/settings snapshots unchanged, before invocation.
Scoped diagnostic promotion completed at 09:38:05.275Z. A single approval expired at epoch1791020405 (09:40:05Z); the one-POST guard was persisted before invoking the owner writer. The runner returned code1 and {"passed":false,"unknown":true,"deployment":"dpl_aDWLBjzq5d72EtCoHavVHub8k6dR"}, response SHA256 c7ae73cbfd194905d971c825b94e42aca320afa999f6ae917b152ec134da8b71. Audit readback contains only delivery.production_proof.approved, with approval digest 684c7d0bdb9b9e37fd7d8cf9c8a929c4a5a42ad9d46531ff28118c1c0086d1e7. No reserved/completed row was observed. This does not establish genuine Vercel acquisition, deployed TLS authentication, SDK result, workload identity or resource binding. The caught response path does not preserve a specific failure cause; none is inferred.
Original outcome artifact: docs/adr0053-workload-proof/results/2026-10-03-tls-acquisition-original.json, SHA256 a773fcd52ac8d088e851a50e50d176edac2afa97737b359c237baf1b6b732203. Raw original audit SHA256 59185bd733a880b8a8e899bc698139ef70379236e4daa5e5f068ce63dcca661a is preserved. Its occurred_at field is the driver's original serialized value; it is not used to infer server or approval chronology.
Approval timing is retained exactly: nbf=1791020284 and exp=1791020405 encode a 121-second exp-nbf span because nbf was backdated one second. Expiry was 120 seconds after the signing clock. This does not claim compliance with a maximum 120-second encoded span. A future separately reviewed runner would need to enforce total span at most120 seconds. No replacement window is authorized.
Separate cleanup and expiry reconciliation
Exact READY cleanup6kMS was promoted at 09:39:03.778Z. All five observed alias targets again match their original pinned values, including the historical alias target. Exact role readback at 09:39:04.442Z shows NOLOGIN, password NULL, no audit SELECT/INSERT, no explicit Delivery USAGE or database CONNECT dependency, accepted original PUBLIC/creator-admin baseline unchanged and zero sessions. No session termination was needed. All seven diagnostic env names/IDs are absent, and original 28 env/settings snapshots remain exact.
The canonical proof route returns404 both without a header and with the formerly approved header. Retained diagnostic and cleanup deployment URLs return protection302/no-store; those results do not establish route absence on retained URLs. Separate verify-cleanup observed the same one approval audit row. Existing approval expiry was verified at 09:40:13.146Z; live custody exited normally, clearing its RAM references. No old stopped attempt or auth-only result was rewritten.
Separate cleanup artifact: docs/adr0053-workload-proof/results/2026-10-03-tls-acquisition-cleanup.json, SHA256 469aa8a8fde404c217ce1d2ee89372167e6f79e43271f185c6f1d703f8f1b6f3. It includes exact alias baseline/stage/restore/cleanup readbacks, explicit-team restore result, immutable local evidence hashes, role/env/settings/route and expiry reconciliation. Cleanup success does not reclassify UNKNOWN.
Production workload/exchange, migration, epoch/role, consumer/resource/provider, financial and activation gates remain open. Frozen local G2, older runtimes and both retention deadlines remain preserved. This is an evidence-only Delivery change, requiring no new runtime tests. Root remains sole canonical publisher/indexer.