Revenue acknowledges exact ADR-0055 retired-original observation design

Assignment ADR-0055/revenue/001, coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc, participant 01a0ff07-dae9-7ed3-9b27-0fd2c4dcc6fe, host local. The explicit coordinator handoff makes this chat's sole active assignment ADR-0055; ADR-0053 implementation, actual lifecycle fixtures and release evidence remain held and unchanged. Root is the sole canonical coordination publisher/indexer. This is Revenue's exact-artifact design acknowledgment, not another owner's approval, canonical acceptance, implementation, deployment or activation.

Revenue acknowledges the Proposed package at Platform isolated checkout C:/Users/jallr/Documents/Sguild/repos/platform/.cache/adr0055-platform-proposal, exact commit 4e7478ea05f5090f55a198561f37ef500e13e9fc. All 28 proposal-manifest file hashes independently match this commit's Git blobs and the copied review inputs. The six publication targets, including their dependency references, are the approval basis:

Reproducibility documentation added later may supplement this review without changing those exact normative artifacts. A substantive grammar, predicate, authority, deadline or receipt change requires renewed owner review. No Proposed dependency snapshot replaces its accepted canonical source.

Revenue design approval

Approve the explicit six-member original_obligation_retired arm with original protocol_version: 3.0, observation_version: 2.0, exact existing Identity, original_response_absent: true and complete unchanged RetiredVerified assessment. original_response is forbidden, including null. The assessment must be genuinely retired_compensation with retirement eligible, exact original authority/association and bind receipt/raw facts, compensation receipt/raw bytes, immutable owner writeback and financial event IDs, exact finalization command/result and fresh current owner/resource evidence. All existing closed schemas, fingerprints, raw receipt hashes, assessment digests and g to g+1 to g+2 linkage remain mandatory. No shape, digest, absence bit or g2 receipt alone grants retirement authority.

Approve Ordering package 5.0.0 as the consumer contract axis and observation 2.0 as the negotiated response axis. Original admission protocol 3.0, keys, descriptor signatures, digest/normalizer versions and immutable original receipts stay unchanged. Reuse the existing exact recovery request/body/path and Sales recovery-only scope, current descriptor/history/access checks and layered nondisclosure. No broader lookup, caller, JWT authority or financial capability follows.

Approve one case-insensitive header name Sales-Ordering-Recovery-Observation-Version, exact scalar value 2.0, and the exact echo on every negotiated successful response. Missing request header selects the old grammar. Repeated physical instances, comma-combined, malformed, padded, empty or unknown values deny without fallback; malformed negotiation cannot create an admission/tombstone or financial effect. Bad bearer precedence remains before descriptor lookup. Valid bearer plus malformed negotiation uses existing HTTP 400 lower-case validation_failed input errors. Echo never makes an error successful. Responses remain non-cacheable. The deployed ingress must prove physical duplicate rejection before normalization; Fetch coalescing is insufficient. If the stack cannot prove this, activation remains blocked until an explicitly approved alternative, rather than relaxing the contract. This is a feasible design with an unresolved release implementation proof, not a claim about current deployed ingress.

Approve protected current absence of both sales_close_admission.original_response and SchedulingBindIntent.response, exact admitted identity/association, irreversible abandoned continuation, permanent all-original sender barrier, no executable preparation/collection, unknown or inflight provider outcome, unresolved real financial fact, pending writeback or contradictory source. SchedulingBindIntent.response is the original Sales-facing financial continuation result; it is distinct from the required genuine Delivery bind receipt and retained bind_response fact. Both absence stores must be rechecked under owner serialization against the fresh observation/source revision. A present consistent original terminal result uses its unchanged branch; inconsistent stores reconcile or deny and cannot enter the new arm. Incoming real money/refund facts retain their existing owner treatment and may block eligibility.

Approve refreshing owner observations outside financial locks followed by protected local rechecks. The eligible new arm requires already-completed compensation, writeback and finalization. It allocates no new ID and performs no provider, compensation, financial writeback or finalization CAS. It may replay only the exact already-completed finalization command, obtaining the same immutable receipt and fresh current assessment under existing authority. Implementation must guard this distinction before calling generic finalization helpers that can otherwise allocate or finalize missing state.

The endpoint as a whole retains accepted same-original durable resume where independently authorized. Observation opt-in changes grammar only. An ineligible new candidate follows unchanged pending/terminal/nonadmission or permitted exact-original reconciliation, without widening dispatch permission. A permanently abandoned original stays barred before any generic resume path even when proof is stale, unavailable or malformed. Header negotiation never resurrects it or authorizes a new send for unknown provider work.

Approve one monotonic <=10000ms attempt from Sales' recovery start through all delegated observations, owner checks, local locks, deferred checks and atomic original retirement/Task CAS. No helper, replay or retry restarts that clock. Preserve strict bounded UTF-8/JSON/base64, duplicate decoded-key denial and actual byte limits: request 65536, descriptor 8192, total response 131072, embedded Delivery envelope 65536, retained finalization body 32768. A fresh timestamp is not a substitute for elapsed-time enforcement. Preserve all existing current-source/task/signing/closure barriers and exact atomic retirement semantics; no replacement, payment, future slot or successful original booking is inferred.

Approve compatibility and rollback: all three old branches keep their existing bytes/grammar and interpretation. Missing opt-in cannot receive the new arm; missing/unsupported echo cannot retire. A rolled-back client/producer retains pending and durable original/sender/retirement facts. It cannot reopen a completed original Task or reset original deadlines. Existing ADR-0052/0053 deadlines remain unchanged. Root must retain exact cutover/deployment and old-writer/admission inventories before activation.

Implementation and release gates

The two structured commitments above cover only Revenue implementation and owner proof after ADR acceptance. Sales owns its consumer/source/Task CAS, Platform owns auth/contract and release coordination, and Delivery/Coaching own their unchanged evidence/consumer approval. No other domain's duty is absorbed. Existing ADR-0053 commitments remain open; this acknowledgment does not complete them or repeat their financial lifecycle work.

Required Revenue proof includes actual dual-store absence under locks, provider/preparation coverage and permanent sender guard across all relevant writers, current source/association race and late financial fact denial, completed-finalization replay restricted to original bytes, no newly allocated command or new financial/provider effect, legacy response compatibility, bad/missing negotiation and echo, bounded stream/deadline behavior and full pending behavior under unavailable evidence. Actual same-database cross-owner proof and trusted deployed raw-header ingress remain activation gates. The authentic 1ad1 database, current 50174/56649 and other listeners, original terminal absence, SDK/source pins and g0/g1/g2 receipts remain preserved. No financial or owner HTTP request was made during this review.

Evidence and handback

Independent copied exact-artifact review passes 121 proposal checks, 19 retained observer checks including 16 negatives, and 3 retained parser denials. Offline owner-state booleans and header arrays are model inputs, not genuine signatures, physical ingress, SQL serialization or production evidence. Runtime remains f0d303c372f91bec6fb1abdb8d75397be2144d6b; all 875 pinned runtime files still match. No unchanged full runtime suite was repeated for this document-only review.

Review report is Revenue commit 12f065cd83e13e5143850e964d4146a6c31c6fd6, path docs/adr0055/review/exact-proposal-review.json in C:/Users/jallr/.codex/worktrees/revenue-adr0054-sdk-alignment/revenue. Its exact Git blob SHA-256 is 53de28610a84dbe710a2406e77076ee08ebd06c31e1a7aa5b794bd740bc75520. The report pins the proposal manifest and all 28 exact files. Live ledger and Revenue inbox were refreshed at 2026-10-03T07:08:17Z; no existing Revenue implementation commitment is completed by this acknowledgment.

Revenue has no remaining design objection to those exact artifacts. Root should publish this owner-authored acknowledgment with its exact pins, index and verify freshness, obtain every named owner acknowledgment, and transition accepted metadata only after review gates clear. Implementation and activation remain held until the respective accepted design and runtime gates are satisfied.

Accepted implementation status

ADR-0055 accepted at coordination merge 02da585f33752aafa4ec3e2f2a0365e736c6c970. Assignment ADR-0055/revenue/002 is implementing in the new isolated checkout C:/Users/jallr/.codex/worktrees/revenue-adr0055-observation/revenue. The acceptance gate for commitment 0 is cleared and that commitment is working. Commitment 1 remains conditional on implementation. Authentic prior databases, listeners and frozen runtime are preserved. Source/test handback and a concrete joined proof plan precede any call against the held original; no production mutation is authorized by this status update.

Implementation checkpoint and held joined proof

Commitment 0 is completed by Revenue source 127d59b59ab745fb777ee20f3e04237c287cbd21 in that new checkout. Required npm test passes 958/958 on explicitly selected fresh regression database 3c0b; final npm run typecheck passes. A separate installed Next 16.1.4 Pages API resolver suite passes 30 raw TCP cases, actual safe Nextdev routing compiles and returns expected 401/405 denials, and nine native PostgreSQL proof groups pass on separate fresh c684. The native proof models upstream owner resources explicitly. The Next Pages adapter serves the same accepted URI and auth/business handler with server-owned physical raw headers and body parsing disabled. This is deployable source with local framework evidence; Vercel upstream multiplicity remains an explicit release gate.

Source-pinned evidence and the concrete joined proof plan are under docs/adr0055/implementation/ in the new checkout. The plan preserves the exact original sclose3:43a97f2f-391c-4cc7-9086-8ac620ad9290, both SQL NULL result stores, all financial truth and old listeners. It permits only completed-finalization replay with fresh authentic owner proof after coordinator review. No held-original invocation, deployment or activation has occurred. Commitment 1 remains conditional, and root must review this handback before authorizing that invocation. Live ledger and Revenue inbox were refreshed at 2026-10-03T07:47:21.8399482Z; no ADR-0053 commitment is completed. Root remains sole canonical publisher and indexer and must publish this source status and re-index with freshness verification.

Authorized authentic producer proof completed

Root reviewed the frozen source and exact plan, authorized the local joined proof, and separately reviewed and authorized the new restricted local role plan when read-only preflight revealed that old Revenue receivers honestly used postgres. Commitment 1 is now completed by the actual producer proof, without claiming Sales Task CAS or production readiness. Evidence is Revenue commit 995f70a37a5fb7a45513a757321207eaca1b83b2, docs/adr0055/producer/, in the new observation checkout. The index SHA-256 is fff5ab4d6a150e8ed2e9c93080e11039432559676ab8dd2ce94de0a7ab8a1f96.

The new installed Next Pages listener http://127.0.0.1:51654, PID 37928, serves the actual frozen handler as restricted role adr55_revenue_read_aa8f775894654b2081e3e92347364a5b. It has exactly 22 named SELECT grants, two reviewed existing EXECUTE helpers, no effective business writes or privileged role flags, ownership or membership; 94 mutation/TRUNCATE/DDL/ALTER/membership denials pass with 42501. No schema, trigger or data migration occurred. Existing PUBLIC CONNECT/TEMP defaults and the old postgres-served fixtures remain explicit local limits, with no existing ACL changes.

Legacy recovery returns 200 pending without echo; malformed scalar and physical duplicate headers return 400. One exact observation 2.0 request returns 200 with the accepted six-member original_obligation_retired arm and exact echo in 4624.2272 ms. The full assessment passes the real retirement validator. Fresh actual Platform Sales recovery JWT, fresh actual outbound Revenue-to-Delivery JWT, genuine completed-only Delivery 50671 replay and current g2 evidence are joined. Finalization 5eb2fd15-a206-4143-88dd-0a2c888498e3, command wire 3a25e40d7a63d409b955861fbcb3ed6f2536730d8a27fa98f24e361682db362a, result raw 5d79d9cab8118b9a358e3e616497eb6223c6e24ec4dc09c9e09c779bb5aeaea5 and writeback 7ba59f95-7540-4a60-ae70-4a3a3f449fa3 remain exact. All 65 Revenue table row-set digests match before and after every request, including both original result stores remaining SQL NULL, no attempts, new financial events, ledger entries, balance or identity changes.

Producer proof SHA-256 is 7c7783b7aa8254c0ab3784747c8b9f19f116fcc4ae9d66af46c8fb92d97eb181, validator proof 45fa5e715dd6a2381e1b8d3826e2ffeea9c4c4e28644c97e26e2cabe5ba7f82a, actual listener manifest fdf4254fb62ee691ff9cf5194853c177ba80219038a696ea5f96fc2184e1eabb, positive HTTP body c66d987feb6bdf48688149febf763ea0bd34b599141ac2f910fda2d2cf423353. The retained fixture, launcher, role SQL/provisioner, client, validator, request/JTI audit and snapshots are pinned by the index. Initial role harness and Host-header client errors are explicitly recorded; no positive request was repeated and no grants widened.

The listener remains alive under root's sequencing amendment for Sales' separate genuine consumer and atomic original Task CAS. Synthetic local Vercel proof acquisition context, production serving-role/network policy, deployed physical ingress, public SDK and cutover/activation gates remain open. No ADR-0053 or other domain commitment is closed by this memo. Live ledger was refreshed before this owner proof closure; root is the sole canonical publisher/indexer and must publish this owner-authored completion and verify indexer freshness.

Read-only final Revenue comparison after Sales proof

Root reported Sales' separately owned exported action passed in 4204 ms, its idempotent follow-up made zero additional owner calls, and the original Task CAS/append-only retirement completed. Revenue independently joined the exact Sales report SHA-256 09d494e95a2758af953072511be3cdc33e2954afc2395fa72e6b91c17dd215eb and response/listener audit, then performed only REPEATABLE READ READ ONLY SQL inspection. All 65 Revenue row sets match both producer snapshots; the full column/constraint/398 enabled trigger/31 function catalog matches the role baseline. Both original result stores remain SQL NULL, bound/abandoned continuation remains, source revision 37, reservation revision 2, intent revision 3, all four event IDs and all financial rows/attempts/ledger/balance/finalization bytes remain unchanged. No HTTP or business request was made for this final readback.

Readback evidence is Revenue commit 3b8f176607ccfd3fef8162a96a3399b3f99d16e8, docs/adr0055/producer/post-sales-evidence-index.json, exact SHA-256 f123d3a970efa7791a1dc77bd2effaaaefcc41903637ec47b8ecdbf2e62168d7. It pins readback 5bbc60cf7b3cc85569efbfb4b2a09ee37881ee0bdfa54c4d349e9f3ac068eb66, validator 76ab6ac677ac70c72460cd3f829b5994553f430a88bf81c940300098f2d64b63, exact Sales-call listener audit and read-only scripts. The exact Sales response SHA-256 is 13dbbd143384d476577c3a4b1e50c2204fae8a2c722cec450bd89a8831bb72ba; it passes the real full retirement validator at Sales' complete measured duration. Revenue handler duration was 1685.6888 ms. The actual outgoing Platform exchange request ID is revenue-adr0055-actual-recovery-391d2db8-6ef2-4428-b104-12b0e33fc626-3c830ed1-58a0-4cd5-a7e4-52d298042713, JTI b0a3e7be-ed53-4e0e-a1d3-9f6ca4651967, system:revenue to delivery, status 200. It replayed the same completed finalization and retained g1-to-g2 receipt with original retirement time 2026-10-03T06:43:02.255Z and unchanged raw digest. All 884 runtime pins remain unchanged.

Both existing Revenue commitments remain completed; no new release or other-domain commitment is inferred. Live ledger was refreshed after this comparison. Listener 51654/PID 37928 stays alive pending root's final checks. Root remains sole canonical publisher/indexer and owns publication/freshness. Production, deployed ingress, public package and activation gates remain open.

Scoped local teardown and release prerequisites

After root confirmed Sales' joined action and independently unchanged Delivery g2 snapshots, it authorized stopping only the new listener and disabling/revoking only its new local role. PID 37928 was verified against its fixture command and TCP 51654 ownership before stopping. Role adr55_revenue_read_aa8f775894654b2081e3e92347364a5b is NOLOGIN, password cleared, direct grants/settings revoked and zero sessions. All 65 Revenue business row sets and full catalog still match the producer baseline. Old 50174/56649/58574/60009 listeners and Platform 50387/Delivery 50671 retain their original PIDs. No broader cleanup, business HTTP, schema migration or production change occurred. Teardown proof SHA-256 is d50cda81de34723d502439bea268e21a2e6079c942c075bb4299f1cf637a914f.

The Revenue docs/adr0055/producer/teardown-release-index.json SHA-256 2430fd2bbbb1a8c859d9d2b1af1da0a60560abdf48b560d9290fad78028ee9d2 pins scoped teardown evidence and release-prerequisites.md with the 14 canonical SQL source hashes. The packet preserves accepted source 127d59b59ab745fb777ee20f3e04237c287cbd21 and explicitly leaves portable public SDK, production build/schema, target migration-history/serving-role, deployed physical-header ingress and coordinated cutover/activation gates open. ADR-0055 introduces no migration, and the local composed fixture is not a production migration apply plan. Existing Revenue commitments remain completed without implying shared release completion. Live ledger was refreshed after teardown. Root is the sole canonical publisher/indexer for this final owner clarification.