ADR-0055/revenue/011 local preparation is complete in docs/adr0055/release-preparation-011. Root remains sole canonical publisher and indexer. This memo is a review artifact, not a production execution authorization or a new cross-domain contract.
Actual 010 serving baseline and accepted 004 original journal reconcile: 49 completed rows, two historical rollback rows, no unresolved rows. Every original journal row is retained unchanged. Exact migration materialization is recorded, including three CRLF representations and 44 physical Windows checkout mismatches. Four pending files have separately reviewable transaction/5-second lock/60-second statement wrapper proposals; all SQL body bytes and original e680 source remain unchanged. Final integration source and portable SDK 2.0.3 publication remain gates.
The proposed NOLOGIN runtime role has Revenue-only named grants, no ownership, privilege inheritance, journal access, control DML, CREATE or TRUNCATE. It retains shared PUBLIC CONNECT/TEMP and five explicit helper grants. Native local tests prove guarded qualified SQL ignores temporary shadows. Target effective foreign PUBLIC/definer reachability and full business-flow attestation remain owner gates.
New isolated evidence proves the complete 12-migration proposal, 68 tables, 63 journal rows, original 51 unchanged, checksum verification, idempotent redeploy and six role/guard cases. An independent exclusive-orders-lock fixture failed writer-epoch DDL within 6.8 seconds with rollback and retained failed journal; rerun stopped with P3009 and unchanged journal. The Prisma CLI surfaces a transaction-aborted message in that failed transaction, not a direct lock-timeout message. A first failure-harness assertion expected a direct lock-timeout string, then a fresh fixture validated the actual surfaced error and persisted invariants. No journal resolve occurred. 33 transition/grant/byte checks pass. Unchanged accepted 004 full suite, native role and refund evidence is reused, not rerun.
The bounded plan requires actual containment of all Revenue immutable deployments, provider/webhook retry buffers, five crons and maintenance writers; positive fresh HTTP/DB/provider drain; exact target/source/alias/runtime-role attestation before any DDL or credential switch; migration credential separation; and forward-compatible recovery after any committed or uncertain migration. Preserve existing payment/bind/capture and four enabled flags, with owner-approved bounded pause and same-key durable truth replay. Shared postgres cannot be globally disabled or foreign sessions killed. Runtime DIRECT_URL cannot retain an owner credential.
Remaining dependencies are explicit: reviewed wrapper/final-source integration, Platform immutable SDK publication and transport/issuer evidence, credential and effective-ACL owners, actual sender/cron containment and drain, final Linux artifact/runtime attestation, and Sales/Delivery composition and release sign-off. No production role/grant/env/flag/migration/deploy/fence/catch-up/business change occurred. The 010 key and claim remain closed, and joined production readiness stays held.