Revenue serving-context diagnostic preparation

Assignment ADR-0055/revenue/005, coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc/local, participant 01a0ff07-dae9-7ed3-9b27-0fd2c4dcc6fe/local. The authorized local source, native-entry proof and cleanup preparation are complete. Root remains sole canonical publisher and indexer. No staging, production invocation, deployment, project environment change, database role/grant change, migration, provider HTTP or financial mutation occurred. Actual serving-role and deployed Vercel/CDN evidence remain pending root review of concrete deployment artifacts.

Diagnostic source is ed414c52522bf9722868fd415c61bb6f61231d17 in C:/Users/jallr/.codex/worktrees/revenue-adr0055-serving-readiness/revenue, branch codex/revenue-adr0055-serving-readiness. Cleanup source is 14090538972f5dea9ae6dfdc05d9f94328afd3a5 in C:/Users/jallr/.codex/worktrees/revenue-adr0055-serving-cleanup/revenue, branch codex/revenue-adr0055-serving-cleanup. Both start from serving checkout ec4665b25a01e575c15983f74569e326cd12b5ff, preserving the released 5417af4cf384ecc91f8a1da7a671a4094993ee05 business correction, all existing business-code and dependency-lock blobs, the genuine Prisma singleton and canonical schema. The actual serving baseline generates 44 models and uses published dispatcher 2.0.2; it is distinct from the integrated004 candidate's 47 models and unpublished2.0.3 validation input. The integrated release's package and activation gates remain unchanged. Separate Square work and all earlier frozen sources, databases, roles and listeners remain untouched.

The temporary Pages endpoint is exact empty POST https://revenue.sguildswim.com/api/internal/adr0055/serving-readiness, default off. Operator admission verifies canonical Ed25519 approval under distinct purpose revenue-serving-readiness-readonly, exact project, actual immutable deployment ID, compiled source, UUID and integer not-before/expiry no more than 60 seconds apart. It does not reuse or widen business Platform token scopes. Physical IncomingMessage raw headers enforce sole Authorization and literal Host, reject transfer encoding, nonzero/duplicate content length, query suffix and any observed body. Signature and empty-body verification precede repository import and all database work. One monotonic 10-second budget covers admission and fixed catalog reads, with safe closed output and generic errors. The approved operator procedure permits at most one request; the endpoint is repeat-safe within expiry and makes no persistent nonce writes.

The actual serving baseline has a direct PrismaPg adapter with no automatic closure entry, so this observer needs no business adapter change. SET TRANSACTION READ ONLY is its first SQL statement, followed by inherited remaining statement/lock timeouts and transaction-local UTC before any catalog query. All reads stay on the actual singleton's pinned transaction/backend. A private sentinel forces rollback on success; native tests prove PostgreSQL write denial, timeout cancellation and pooled setting restoration. No alternate admin/observer Prisma client, SET ROLE, caller SQL/target/schema override, provider path, domain write or business-row query exists in the endpoint. Genuine generated-client metadata attests 44 models and canonical namespace without exposing its schema/configuration. The fixed projection reports role/ownership/BYPASS and effective ACL facts, configured target-match booleans/hash, migration names/checksums/timestamps, guard inventory and six existing flags. A privileged actual role is reported as a gap rather than concealed or replaced; no dedicated SELECT-only production role is required for this diagnostic.

Both source candidates correct the baseline's residual migration-first vercel.json build command to npm run build, retaining all five cron entries and other business configuration. Cleanup removes every diagnostic route, module, gate and source-embedding hook, retaining only that safe build-command correction. The diagnostic changes two other existing files: private scratch exclusion and public source identity embedding. Declared build source must match committed HEAD where Git metadata exists. No private key, bearer or connection value is embedded. Root must verify complete source/upload/configuration hashes in any later portable artifact build.

Final local checks passed 51 focused tests and canonical typecheck, including typecheck after Next generated Pages compatibility declarations. Both builds passed with explicit NODE_ENV=production; earlier fixture-test-environment build attempts are excluded from final build evidence. Eight native groups passed on a fresh schema-only 47-table loopback fixture with 51 sanitized migration metadata rows and zero copied business/control rows. The actual privileged local role is explicitly recorded and is not a production-role claim. The actual Node HTTP bridge returned200 for a signed empty request and404 for physical duplicate authorization, body, transfer encoding, query and gate-off cases with zero transactions. A separate compiled Pages artifact ran through Next16.1.4's real local API resolver: empty approved POST returned200 with native read-only44-model evidence; wrong-source and physical duplicate-auth requests returned404. Compiled body parsing is disabled, and the embedded committed source overrides a decoy runtime source value. These remain local Node/Next proofs, not deployed Vercel/CDN attestation.

The packet is docs/adr0055/serving-readiness/, with release-packet.json, source-preservation.json, source-manifest.json, manifest.json, native/compiled proof reports and exact archived launchers. Current read-only project inspection still reports Ready/promoted dpl_DjpzM72TiEFko4BUBXFmjDG19rTJ, source5417, Node24.x and system environment exposure enabled. Local Windows/Node24.13 builds are verification, not staged portable deployment artifacts. The live ADR0055 ledger and Revenue inbox were refreshed read-only; no unrelated commitment was completed.

The bounded future procedure requires root to review matching portable production artifacts and exact business environment binding, then stage both Ready deployments with explicit team team_byXeghD9Vv0Kd5UKuKWBqQb9, --prebuilt --prod --skip-domain, without alias promotion. Root separately approves the two immutable IDs before any promotion/signature/request. Root-held fresh Ed25519 private key remains in memory; only the public key and private enabled gate enter deployment-scoped diagnostic configuration. After exact canonical diagnostic promotion and source verification, issue at most one empty HTTPS POST, then immediately promote the reviewed cleanup on every outcome. Verify Ready/source/alias, canonical404, removal of only owned temporary context and expiry/key destruction. Historical immutable artifact retirement must not be claimed without separate exact-resource evidence. Unknown outcomes require inspection, not blind retries. The route must be removed before the integrated004 adapter is introduced because its entry composition differs. Root should publish this owner-authored memo and packet pins in its coherent canonical batch and run indexer/freshness there.