Revenue bounded release preparation
Assignment ADR-0055/revenue/004, coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc/local, participant 01a0ff07-dae9-7ed3-9b27-0fd2c4dcc6fe/local. The authorized isolated implementation and local release preparation are complete. Source commit is e6806d9a73bd1607b9ddc26a807e4744c7ba00ad, checkout C:/Users/jallr/.codex/worktrees/revenue-adr0055-release/revenue, branch codex/revenue-adr0055-release. Root remains sole canonical publisher and indexer. This memo does not complete shared production activation or alter another ADR's ownership.
The candidate preserves the serving 5417af4cf384ecc91f8a1da7a671a4094993ee05 identity correction and accepted frozen 127d59b59ab745fb777ee20f3e04237c287cbd21 implementation. All 884 frozen physical source pins remain unchanged. The primary checkout, other Revenue Square work, earlier databases, roles and listeners were not changed. Fresh read-only project inspection still reports Ready/promoted deployment dpl_DjpzM72TiEFko4BUBXFmjDG19rTJ with that serving source.
The common Prisma adapter now enters the closure lock and scheduling compatibility marker on one transaction before domain, FK or unique locks for ordinary standalone, batch, interactive and raw writers. The marker conveys compatibility, not original-intent authority. Recovery entry checks the inherited monotonic deadline and sets transaction-local SQL timeout before its common-lock wait; entry failure rolls back before the domain callback. The 13-family audit covers provider preparation, retries, cron and maintenance paths, and retains explicit drain requirements. Provider success, internal financial writeback and sender idempotency remain separate facts.
Vercel builds use npm run build without implicit migration. The explicit deploy script requires exactly canonical schema revenue, rejects alternate schema overrides, and removes the former db push --accept-data-loss branch. A production bundler error required changing the inline capture expression to a NUL-joined array; the preimage retains both NUL separators and the accepted capture and request digests exactly. The twelve pending SQL files retain their original reviewed physical bytes. Git attributes now preserve those exact bytes across checkouts; their normalized SQL is unchanged and no historical migration checksum was rewritten.
The fresh local canonical rehearsal used a read-only schema-only export of the verified 47-table catalog and retained all 51 original migration journal rows, including the two historical rolled-back attempts. No business data was copied. All twelve exact pending migrations applied in lexical order, resulting in 68 tables and 63 journal rows. Explicit no-pending redeploy was idempotent and catalog/journal snapshots remained identical. Public journal evidence contains original log hashes and byte counts, not raw logs or credentials.
Nine native groups passed using an actual fresh nonowner restricted LOGIN role, including old-writer denial, ordinary writer entry, same-connection marker order, pooled cleanup, rollback, common-lock serialization and deadline cancellation before the callback. Three real ordinary refund service groups passed transactional initiation, rollback on injected completion outbox failure, exactly-once debit/account/order/event writeback on retry and noop replay. Synthetic business inputs, a same-transaction recording dispatcher and an explicit Delivery settlement double bound this evidence. No joined compensation/refund race or genuine provider ingress proof is claimed. The new local role is now NOLOGIN with NULL password, zero direct grants and sessions; all retained table fingerprints and the 63-row journal are unchanged by teardown.
Required final local checks passed: npm test, 101 files and 1,002 tests; canonical-client npm run typecheck; production npm run build, including the Pages recovery handler; npm run dispatcher:smoke, eight validated envelopes; and npm run audit:ledger, one entry and zero violations. Final generated metadata is 47 models, namespace revenue, schema SHA-256 42be66253b46b26a77afc253adf9af9658ccdd2d57cfce474bb99621a65a4b6d. Launchers restrict database targets to the new local replicas and block nonloopback HTTP. The exact dispatcher 2.0.3 archive SHA-256 66b8382e302dbf440831341cf6341d492b4041c85fb934f29572ec7e3aac4731 is an unpublished LOCAL validation input only. This is not a portable final deployment candidate.
Evidence is under docs/adr0055/release-candidate/: release-package.md and release-package.json state results and limits; manifest.json pins public artifacts; source-manifest.json pins physical and committed source bytes; final-source-preservation.json pins frozen-source and SQL representation checks. Native execution sources are archived byte-identically as .ts.txt, with their original execution paths retained in reports and the mapping recorded in the release package. The source-reviewed actual-serving-client diagnostic and cleanup method is a plan only, not a new executable route.
Remaining shared release gates are public immutable dispatcher packaging and owner login, actual serving application target/role/ACL attestation, approved read-only diagnostic entry and cleanup, deployed raw-header/authenticated owner proof, complete old-writer/provider/retry/cron/operator drain and separate maintenance credentials, and domain release/activation sign-offs. Square changes retain their separate owner. No production writes, migrations, grants, flags, provider HTTP, deployment or activation occurred. The live ledger and Revenue inbox were refreshed read-only for this ADR; no unrelated commitment was completed or reopened. Root should publish this owner-authored memo with the exact source and evidence pins and run canonical indexing/freshness in its serialized publication batch.