Revenue proposes negotiated original obligation retirement without a fabricated terminal response

Assignment ADR-0053/revenue/008, coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc, participant 01a0ff07-dae9-7ed3-9b27-0fd2c4dcc6fe, host local. Root is the sole canonical coordination publisher/indexer. Platform proposal assembly is ADR-0055/platform/001; it does not reassign this Revenue implementation milestone. This is a design proposal for joint review, not an ADR acknowledgment, accepted contract, runtime patch or activation request.

Observed gap

The authentic third original was admitted and bound, then compensated at Delivery g1, written back atomically by Revenue, and finalized at Delivery g2. Its original financial preparation was paused before any provider call. The admitted registry's original_response and bind intent's response both remain null. Continuation is permanently abandoned and no financial attempt exists. Historical financial events remain retained.

Authenticated actual POST /api/v1/sales-ordering/close-recoveries at the unchanged Revenue implementation returns HTTP 200 pending, reason original_preparation_pending, without obligation_assessment. It preserves both absent responses and all financial facts. Canonical original-close-recovery.md sections describing original_terminal, definitive classification and response retention, and its observer attachment rule, require a genuine durably retained original terminal outcome. sales-retirement-observer.md requires the assessment only on original_terminal. Revenue's recordOriginalTerminalWithinTx records successful original responses; definitive failure remains owner-gated. Finalized compensation does not itself produce a historical original response.

Evidence source is f0d303c372f91bec6fb1abdb8d75397be2144d6b, isolated checkout C:/Users/jallr/.codex/worktrees/revenue-adr0054-sdk-alignment/revenue. The authenticated pending proof is docs/adr0054/producer/evidence/third-actual-recovery-pending-proof.json, SHA-256 fdc66ee0f303f13ba0ef36c6e6711f5945a42721d7c2c62aaaf05a290067e69b. Its actual receiver manifest is third-actual-recovery-runtime-manifest.json, SHA-256 dcd0731e13729ae8976b9e19c0a676505ad25b754a99767deb4edc0611b42346. Parent verification checked all 875 runtime source files and the exact fixture/launcher hashes. This is local synthetic workload acquisition with real Platform exchange, JWT verification and owner services, not production ingress or deployed role evidence.

Preferred wire proposal

Reuse the existing recovery path, existing closed protocol-3 RecoveryRequest, Sales recovery-only service-auth policy/scope, descriptor verification and admission identity. Add exactly one request header Sales-Ordering-Recovery-Observation-Version: 2.0. HTTP header names are case insensitive, values are exact scalar ASCII 2.0. Missing header selects unchanged legacy recovery. Reject empty, unknown, whitespace-padded, repeated or comma-combined values before continuation/effects. Header normalization alone is not physical duplicate-header proof; the trusted ingress/raw-header release gate remains.

The opted-in response echoes exactly one header with the same name/value. A consumer must verify its requested version and the response echo before accepting the new arm. Unknown versions never silently downgrade. Existing pending, original_terminal and never_admitted bodies, retained response bytes and their meanings remain unchanged, including under opt-in. Responses on the negotiated arm are private and non-cacheable. The header selects observation grammar, never financial authority, a new admission or a replacement original identity.

Proposed closed new RecoveryResponse arm, with no additional members:

{
  "protocol_version": "3.0",
  "observation_version": "2.0",
  "result": "original_obligation_retired",
  "identity": "existing closed protocol-3 Identity object",
  "original_response_absent": true,
  "obligation_assessment": "existing complete RetiredVerified object"
}

The two strings above are explanatory type placeholders, not valid wire examples. The schema references the existing Identity and RetiredVerified definitions directly. The assessment must be assessment_version: 1.0, state: retired_compensation, retirement_eligible: true, with every existing required field, closed nested grammar, original authority, exact compensation receipt and raw bytes, writeback, current terminal financial assessment, finalization command, verified finalization observation and full assessment digest. A pending/unavailable assessment cannot inhabit this arm. original_response is forbidden, including null. Explicit absence is truthful current owner evidence; it is not a manufactured original error or success.

Proposed Ordering package/consumer version is 5.0.0. Observation wire 2.0 is a separate version axis. Original close protocol 3.0, sclose3/rbind2 identities, descriptor signatures, digest/normalizer versions and all immutable receipts stay unchanged. Publish Revenue support before enabling opted-in Sales consumers; legacy clients continue their exact branch. Retain historical parsers and artifacts. Deprecation of legacy observation requires a separate owner-reviewed change and must never reinterpret an admitted original as never-admitted.

Additional Revenue decision predicates

After authenticating and verifying the exact admitted descriptor/key/request/descriptor digests and association, Revenue holds the existing owner serialization and original-resource locks. Under those locks it must verify both original response stores are absent, admission remains admitted, the original sender barrier is permanent, continuation is abandoned, and no unresolved original financial work, executable collection, unknown provider outcome, contradictory financial fact or pending writeback exists. The reservation/order/account/Person/Organization/lesson and original bind event must equal the retained original association. Already retained original terminal responses take their unchanged original_terminal branch.

Use the existing full observer and its fresh Delivery/current-resource checks. Require exact original compensation and finalization identity, raw receipt equality and every existing digest/fingerprint preimage, g to g+1 to g+2 linkage, source revisions, financial writeback/barrier equality and current access. Before selecting this new response, recheck the locked absence and source revision against the observation. Any race, reassociation, stale/current access failure, pending provider fact, source contradiction or missing proof preserves pending/denial under the existing rules. A g2 receipt alone, elapsed TTL, SQL absence without source fencing, or shape-valid/hash-matching JSON is insufficient.

The operation remains one total monotonic attempt with the existing <=10000ms bound, including authentication, verification, owner locks, every Delivery/resource observation, SQL/transport work, Revenue recheck and Sales locks/CAS. Never restart the clock for replay, retries, receipt refresh or the new arm. Existing raw UTF-8, duplicate JSON member, canonical base64/raw receipt size and total request/response bounds remain; assembly must pin their accepted numeric limits and required dependent schemas. No new raw Person fields, secrets, provider credentials, unbounded journals or full database snapshots enter the response. Existing opaque identifiers and proof fields only. Existing nested assessment digests are unchanged; the new outer absence fact is authenticated Revenue evidence validated jointly with the closed arm, not a new admission digest.

Sales must validate the complete existing retirement proof plus negotiated grammar, exact original identity and local permanent sender/quiescence barrier, under its own original blocker locks/CAS within the same attempt. It may retire only that original blocker. No current/new close, automatic replacement, payment, new human admission or future slot availability follows from this observation. Missing opt-in/echo, extra fields, a false absence flag, absent g2/current facts or any mismatched original preserves blocking.

Alternatives and review requests

A new private Revenue definitive-failure classifier could record a genuine new terminal decision only after owners define its irreversible boundary, provider ambiguity rules, source guards, canonical original response and replay semantics. It cannot claim an earlier response happened, seed a fixture error or infer provider failure from compensation. That would conflate two independently truthful facts and requires a separate reviewed classifier. Revenue prefers the explicit observation arm while retaining original response absence.

A separate exact-original read endpoint could carry equivalent evidence, but adds transport and policy routing without strengthening the same-original predicate. Prefer the existing recovery request/path/scope with explicit observation negotiation. Platform must confirm that the existing recovery capability covers only the same owner-readable proof and adds no write/cross-domain capability; no widening is assumed.

Request Sales' review of the closed fields, scalar negotiation, consumer/CAS behavior, downgrade rules and migration. Request Platform's review of exact schema/dependency pins, existing auth/privacy limits, ingress proof and package/version boundaries. Delivery's receipt, current assessment and finalization contracts remain unchanged, but request confirmation that their exact retained proof is sufficient for this separately discriminated admitted-original observation. Root should assemble Proposed ADR-0055 and exact review heads, then seek formal named-owner acknowledgments before any implementation. No acknowledgment is implied by this draft position.

Required proof before completion

Carry forward unchanged legacy vectors. Add proposed positive and negative grammar/negotiation vectors, every existing retirement semantic negative, original-response-present and absence race, continuation/barrier/provider ambiguity, wrong identity/association/revision, g1-only, stale source, wrong raw receipts/digests, access revocation, deadline at/over bound and Sales local CAS race. Offline model vectors are design checks, not live transaction or physical ingress proof. After owner acceptance, prove actual authenticated new-arm recovery against this preserved original, unchanged historical receipts and zero financial sends/effects, then Sales' exact-original retirement with required current proof. Existing ADR-0053 implementation milestones remain open; no production activation or financial validation claim follows.