Revenue accepted original-source proof checkpoint

Assignment ADR-0053/revenue/008, coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc, host local, participant 01a0ff07-dae9-7ed3-9b27-0fd2c4dcc6fe. Implementation remains in the isolated Revenue checkout C:/Users/jallr/.codex/worktrees/revenue-adr0052/revenue, branch codex/adr0052-revenue. Root is the sole coordination publisher/indexer. Production activation remains off.

Accepted ADR-0054 technical head 8dc1f75dd4aaeb586df7ca6bfa4bf5a351efed39, merge 005a0696ed4092579c2bbd32de6d30337fd3766a, supplies the original association source, frozen quantity and original-event correlation rule. The implementation checkpoint 96a74a6c1aa65669afb56fe556afebbe9a117d24 includes the strict fresh source consumer, immutable local snapshot, exact quantity/window guards, common original successful event correlation and bounded authority transaction. SQL corrections are additive migrations 20261003050000 through 20261003090000; no installed migration bytes or retained original context/receipt/evidence were rewritten.

Evidence commit 12df63d retains reports and validation summary under docs/adr0054/revenue-local/, with implementation/release notes in docs/adr0053/. Final local npm test passed 903/903, zero failures and zero skips; typecheck passed. Dispatcher smoke passed eight local recording envelopes. The isolated ledger audit returned zero rows and zero violations, not a production financial audit.

Separate evidence classes

1. Fresh positive Revenue original: real PostgreSQL compensation 15/15, Ordering 8/8. Actual Revenue ordering persists original quantity atomically; source preparation verifies exact context/current Decimal/full association equality, original window and immutable raw capture. Actual dispatcher wrapper commits one credit release and one order update, sharing the original bind event correlation, with zero ledger/balance delta and stable cached proof/event IDs. Real delayed insert and deferred-check cases roll back within the remaining source-read deadline. Operational Delivery source/effects and Identity verdict are explicit bounded doubles.
2. Preserved deficient original: 3/3 fail-closed checks on the earlier isolated fixture. Original quantity is absent, so source preparation, compensation and finalization remain ineligible. Zero source reads/sends, zero second operational effect or financial events, unchanged financial state and byte-identical context/receipt/evidence. No provenance backfill.
3. Actual issuer/consumer exchange: docs/adr0054-original-source-auth-proof.json pins Platform runtime ad20c705895bd48786e6fc0e14939050a5013b1f, loopback issuer 50387 and source read consumer. Platform independently confirmed all five expected audit requests and three issued JTIs; exact owner confirmation is retained at docs/adr0054/issuer/revenue-audit-confirmation.json, SHA-256 c74a6d930304bb90a8a87f43028880a5c05b2404e56aafe6f5d1c4bcb95b4986. Workload proof is synthetic local SDK input and Delivery response is an accepted vector double. This does not establish authentic Delivery handler/database provenance.

The preserved deadline diagnostic pins failed runtime 4010fd2153738a33ceb4cb8e8ef9aabcb2d15f87 and corrected runtime dc5c2f12806ca67605536f837603ab8ca630dbc9. PostgreSQL deferred checks are forced inside the cancellable callback before returning. A physical COMMIT acknowledgment arriving after the deadline is an unknown retained outcome, never a fresh positive; rollback after durable commit is not claimed.

Integrated release status

The fresh Revenue loopback receiver is separate from both earlier proof databases: revenue_adr0053_428badd14789417b9ecfa01d7f21e453/revenue_test. Its Node Web HTTP bridge mounts the actual authenticated recovery handler, with financial close unmounted, external actions/fanout disabled and actual local Platform 50387 JWK verification. The unused initial Sales key/configuration is preserved; the coordinator-approved replacement entered monotonic generation 2 with the old key retired and the new exact key active, without fabricating signing audit or rewriting history. New listener http://127.0.0.1:60009, PID 23092, pins source d15ba2051b1288baa8e012f2494a276622677460, with final typecheck passed after fixture changes. Old PID 2656/listener 65075 remains untouched and its stale generation cannot admit against watermark 2.

Exact retained receiver manifest docs/adr0054/revenue-local/receiver-v2-runtime-manifest.json SHA-256 a88ae0294ae901bef4bd4c3890a21c43e50c899119586b77c68aef112e9fdf9c pins 865 runtime files, fourteen installed SQL steps, compiled schema 4abc4acdb3742d13673f58ec757f0cd7bb02429349bed70e4ab652fbfda833f3 and SQL catalog 427b777810dea14807ad419b0f5bf5c74a52f83dca6298b6d09891811c12422c. Exact Sales replacement manifest SHA-256 0700c2626b45d2da6fd563aca1b02c3dcc5bfe1341f97646451ea9dfadaaf2f2, key sales-close-admission-v1-local-72c33e82-cd11-4e00-83cd-0a6b669abc36, SPKI hash 7e886f2684c9f533a6506e0d7a814395739b5e4c7b8c8dd76c060673ad230b0b were independently verified, including all six source hashes. No signed original or positive recovery was constructed by this receiver preparation.

Post-transition state proof in docs/adr0054/revenue-local/receiver-v2-state-proof.json confirms watermark 2, two keys (new active, old retired), retained immutable audit generations 1 and 2, and zero admissions/orders/bind intents/financial attempts/events. The old listener's stale-generation exclusion is verified from source/configuration, not an authenticated old-listener HTTP probe. Evidence handback commit 5f19d90 retains the state proof and complete source/evidence pin manifest, SHA-256 b7579ecc61d70ec7450d6418636728899a8cbedac4ec09ee07376f371667b165.

Authentic Sales signing output and actual Delivery raw original/soft-resolution provenance remain prerequisites for the D1, Revenue never-admitted, D2 join. Sales must durably admit each new command before actual Delivery create. Older Delivery-only receipts without that prospective lineage are preserved as Delivery-only proof and never retrospectively adopted or signed. Production role isolation, real ingress, original workload SDK provenance, provider idempotency, all-writer turnover and old sender drain remain open release gates. Local DB installation starts with a fresh baseline and explicit SQL steps, not the historical production migration chain.

Live ledger refresh 2026-10-03T05:17:22.095Z still shows all three source memo commitments working / in_progress, with no blockers. This checkpoint does not complete them or emit a release/activation event. Root should publish/index this memo with the exact final receiver handback; no participant re-index or production action is authorized by these results.