Sales 022/023 owner position
Sales completed the bounded preparation at commit 535c59484276af9b2cf93d45d9ea2e3562b13ab2, preserving 18cb and historical 019/020/021/022 proofs. The diagnostic now qualifies PostgreSQL catalogs and reports its normalized transaction-local search path. Its read-only/auth boundaries passed 21 targeted tests; the affected suite passed 2,409 tests and type checking. A fresh restricted-role PostgreSQL rehearsal reproduced the original temporary-catalog misreport and verified the committed fix without changing protected history.
The 022 direct TLS read-only proof used the exact Sales project endpoint, pinned public CA and Windows Prisma 7.8 native engine. Both pg and the native engine matched all original 93 Sales and 25 public migration rows. Native startup limits were checked, the 200ms statement timeout cancelled a bounded sleep, and an unrelated CA was rejected. This does not authorize DDL or certify a session-pooler connection. The exact native engine/direct transport and future actual-target/limits gates remain pinned.
Root's accepted permission disposition is retained: inherited PUBLIC TEMPORARY/CONNECT and public USAGE need not be revoked. The scoped runtime role has no persistent-schema CREATE, protected ownership, role membership or administrative bypass. Dispatcher 2.0.1 remains pinned for the active Sales publish/inbox path. Verified 2.0.3 changes do not repair the separate external-actions delegate or require foreign grants. No unnecessary dependency upgrade was made.
The native Linux ARM64 Node 24.13.0 artifact was built from clean 535c594 with the exact lockfile, offline install and a direct Next build. No production credential entered the build, and no implicit migrate or prompt installer ran. The output pins 1,090 regular files, 148 symlinks, five physical function configurations and their routing links, 48 Sales schema models, the generated client, SDK 2.0.1 and paused controls. The JavaScript/wasm output contains no architecture-specific native binaries; function configurations target ARM64 Node 24. Nine packaged cron/auth/ADR-0049 smoke checks passed with zero network attempts.
Artifact archive: sales-535c594-paused-build-output.tar.gz, SHA256 b4337cf85435ec837bacca6816561df435c247e4ee4c2cc8bf4cf2682cb005f9. Artifact manifest SHA256: fa98495dbb801617025630c4da2e2217126aa805f1a65f08824ebf0a3c357b45. This is a local Build Output, not a staged or READY deployment.
The output disables new closure/scheduling/ordering work and saved recovery, pins automated SMS false and has no cron definitions. It does not make ordinary Sales writes read-only. Therefore the accepted Platform015 deny fence, project cron disablement, producer buffering and positive Sales writer drain are prerequisites even for staging. No app-wide switch or cross-domain design was invented. Current project metadata has no production automated-SMS flag; source defaults disabled, but Vercel did not expose the immutable deployed value. This limitation is retained, and no SMS was sent.
The executable review packet at C:/Users/jallr/Documents/Sguild/repos/sales/.cache/release023/ integrates Platform015, inventories Sales HTTP/cron/inbox/provider/CI/manual/direct writers and requires positive completion evidence under a 10-minute drain ceiling. Root owns provider coverage and any mutation. Unknown old writers or continuation outcomes block DDL; elapsed time, aliases and shared Supavisor sessions are not proof of drain.
New claim ID: d142c83a-9d99-4244-a1f7-d12cbc486eac. Plan SHA256: 5c2abc3cb43a054d50b4a8afdb217bc8f64e2a3f0cb955e680b2d8dc37bf7142. The default helper only verifies pins. Its future apply phase requires exact time-limited approval and accepted evidence hashes, an exclusive local claim plus stable database advisory claim, the original journal preimage, seven exact migration files, bounded direct native-engine execution and accepted 021 role SQL. It stops and retains evidence on any mismatch or partial failure. Credential provisioning is a distinct approved phase after NOLOGIN role creation. The deliberately invalid approval template was rejected before claim creation; no apply phase ran.
Same-source paused recovery uses this exact artifact and the restricted role. It retains guards, journals, signed history, original keys, Tasks and epochs, and never restores ff4/older parsers or the administrative runtime credential after new history exists. Function-level paused overrides require a separately reviewed artifact/configuration transition for saved-key recovery; project flag changes alone cannot override them.
Remaining dependencies are root's provider-fence acceptance and positive writer drain; secure credential provisioning and approved database phases; later prebuilt staging, uploaded-file/READY and actual application-role verification; and the existing producer/trust/signing/verifier/supported-flow gates. No production role, ACL, environment, migration, deployment, control, financial or business mutation occurred. Root remains sole canonical publisher; this file is an owner-authored local draft.