Sales acknowledges the exact ADR0055 proposal with gated consumer commitments

Sales acknowledges the design in the exact proposed artifact package at Platform commit 4e7478ea05f5090f55a198561f37ef500e13e9fc. There are no Sales design objections to that wire. This owner acknowledgment does not accept the ADR on behalf of other owners or authorize implementation, deployment or activation. Root remains the sole canonical publisher and indexer. This file is staged in Sales for root publication on the requested review thread.

Exact reviewed artifacts

The package is docs/adr0055-proposal in the isolated Platform proposal checkout. At reviewed commit 4e7478ea05f5090f55a198561f37ef500e13e9fc, the exact committed proposal-manifest.json SHA256 is 526728092a2d88f02fe4bfe634d51f29392c858c077da4e0dfacc709a0973159, with 28 pinned files. Sales independently verified all 28 original committed blob pins, read the complete ADR, overlay, schema, positive fixture, review vectors and validator, and reproduced the offline validator in a Sales-owned scratch copy. It passed 121 proposal checks, 19 retained observer checks and 3 strict parser checks. Those checks are schema and owner-state models, not authentic signatures, real ingress, database serialization or production evidence.

The subsequently inspected manifest SHA256 170b580ed67ebb08fb74991fa1a1255120ebe8d21d554b601f7789204e679a66 belongs to reproducibility package commit 18b85a4d056b9809ef9c74122416178a02602690, with 32 pinned files. It is not the original 28-file manifest. Sales verified both manifest blobs and confirmed that the six normative artifact hashes below are unchanged between those commits. This attribution correction adds no wire review, implementation or runtime claim.

The acknowledgment pins these publication artifacts:

The three validation paths in the table are under contracts/sales-ordering-surface/. An edited wire or semantic requirement requires another exact review. Canonical reproducibility documentation may be added without changing these reviewed bytes; it cannot silently broaden this acknowledgment.

Sales findings and interpretation

Sales approves Ordering package 5.0.0 and observation 2.0 as distinct from immutable original admission protocol 3.0. Original namespace sclose3, request, identity, descriptor, digest/normalizer and raw201 lineage remain frozen. The existing closed five-member recovery request and scope remain unchanged. The new result has exactly six required members, forbids original_response even null, and references the unchanged complete Identity and full RetiredVerified proof. Existing legacy bodies receive no additional body fields.

Sales approves the exact single scalar Sales-Ordering-Recovery-Observation-Version: 2.0 request header and exact response echo on every successful negotiated response, including a legacy result. Missing opt-in selects legacy. Unsupported, comma-combined, malformed, physically repeated or differently cased duplicate fields cannot disclose evidence or trigger downgrade. A version echo on an error is not success. Auth precedence, input-error layer and nondisclosure remain unchanged.

Physical duplicate rejection is a release requirement, not something the schema or Fetch Headers.get() proves. Trusted deployed ingress must demonstrate multiplicity handling before normalization. Sales must also establish response echo handling at its trusted transport boundary. If that property is unavailable on the actual stack, activation stays blocked until owners approve an alternative such as a new closed body selector. This acknowledgment does not approve a relaxed header rule or that alternative in advance.

The absence statement requires both Revenue sales_close_admission.original_response and SchedulingBindIntent.response absent under owner serialization. The latter is the original Sales-facing close result, not the authentic Delivery bind receipt. Genuine bind receipt/raw bytes, exact Association, compensation authority/preimages/receipt, both financial events and canonical writeback, finalization command and exact retained bytes, G1/G2 progression, current revisions, financial assessment and enforced sender barrier remain mandatory. NULL stores, a boolean, G2 alone or a valid digest never substitute for this complete independently verified proof. Consistent present original results use the existing terminal branch; inconsistent stores deny retirement pending owner reconciliation.

The whole endpoint retains accepted same-original durable resume. Opt-in changes response grammar only. The eligible new branch performs no new ID, provider, compensation, writeback or finalization CAS effect; replay of the exact completed finalization may obtain its retained result and fresh observation under existing authorization. If the branch is ineligible, accepted legacy reconciliation and already-authorized same-original resume remain intact. The overlay's missing-condition pending rule describes an abandoned retirement candidate, not removal of existing active-original resume. An irrevocably abandoned candidate is checked and permanently barred before generic resume, including when proof is missing, stale or unavailable. Unknown provider work gains no send permission from negotiation.

Sales will independently join the outer identity, descriptor, saved command/raw201 and full proof, preserve the strict JSON/UTF8/canonical base64 and raw hash rules, and enforce actual byte bounds (65536 request, 131072 recovery, 65536 embedded Delivery envelope, 32768 retained finalization body, 8192 compact descriptor). The total monotonic ten-second attempt covers every delegated owner read, streamed body, subsequent local locks, source/version recheck, deferred SQL checks and final commit authorization. It cannot restart after an intermediate observation or use a fresh local timestamp to extend stale owner evidence. A timeout, mismatch or uncertain observation retains the blocker.

Only the same original append-only retirement and exact Task completion may commit atomically. Existing Lead/original/Task barriers protect concurrent signing, sending, completion and closure. No success projection, paid booking, customer handoff, replacement admission or new financial authority follows. Sales implementation will preserve strict existing commit enforcement, including its stricter rejection when no commit budget remains.

Commitments and release evidence

The structured implementation commitments are conditional on accepted ADR0055 and the published Ordering 5.0.0 contract. They do not start a new ADR0052/0053 deprecation clock or extend an existing deadline. Root must retain compatible producer/consumer deployment pins, sender/admission coverage, cutover inventory and rollback ownership before activation.

After that disposition, Sales will prove the new branch using the held authentic third original and the same Revenue producer database, current independently authenticated owner reads, exact immutable original and finalization bytes, and actual Sales transaction locks. Evidence must demonstrate zero new financial/provider/create effects, atomic retirement/Task completion, idempotent retry, concurrent source/Task denial, lock and stream deadlines, deferred-check rollback and unchanged legacy handling. Runtime ingress, owner sender quiescence and owner serialization remain independent requirements; the offline model does not close them.

Rollback disables new negotiation/consumption, preserves all immutable original, compensation, finalization, barrier and retirement facts, and neither reopens a retired Task nor resumes an abandoned sender. Missing echo, old producer, old client and unavailable proof retain truthful legacy pending without fallback. Existing descriptorless no-send, never-admitted, original-success and clock-fault histories remain distinct.

At the earlier proposal-review checkpoint, the actual third Sales recovery was pending/recovery_pending, its exact Task was open, and all retained journals and fixtures were held unchanged. That historical report SHA256 is 69832420d289f65e5d34681ec3e3a7d1f38cd966825f76b61fb1275c1cd07e20; independent issuer audit SHA256 is 9f62e12671058f5046c75bddec3cd5a921fdcdae651dc90d22010ec58986e116. The proposal review itself issued no new owner request, provider call, implementation or activation.

Accepted implementation handoff

ADR0055 and Ordering5.0.0 were accepted at merge 02da585f33752aafa4ec3e2f2a0365e736c6c970, with implementation handoff 443c03b0558777356e9c81c7711802979a3cf4a9. Assignment ADR-0055/sales/002 completed the local consumer implementation in isolated branch codex/sales-adr0055-consumer. The design gates are cleared. The subsequent authorized actual same-database joined proof is complete as detailed below. Root publishes this owner-authored status update. Earlier acknowledgment and its evidence are retained above.

Completed local-proof commitment

Sales marks commitment index2 completed for local proof only. Source 5d8cb4d9ad8c064f45bf5dca51b80bf51e3b59a1, source manifest SHA256 31681612d96275e1fb06dc7ca315c0a2591bf8a7d414c33d2a062499a689cf99, includes independently verified schema/provenance and all938 source pins. Validation passed 148 changed tests, 187 complete retirement tests, TypeScript, 25 real isolated PostgreSQL groups including races and deferred rollback, and the actual joined same-database invocation below. Those distinct scopes are retained explicitly; model owner assessments were not used in the actual joined invocation.

The coordinator authorized the exact held migration/minimum role and then the actual fresh recovery action after genuine producer proof. Sales obtained fresh actual Platform50387 policy exchanges, observational Delivery50251 D1, and the native Revenue51654 HTTP200 six-member result with one exact observation2.0 echo. The unchanged exported action verified the full proof and source joins, rechecked current evidence under local barriers, and committed one append-only retirement plus the exact Task completion in4204ms. The exported action replay caused zero additional issuer/owner request or local effect. All original bytes, other Tasks, all Lead rows and booking/outbox/success-completion counts remained unchanged. No original_response was created and the supplied success projector was never called.

Joined evidence commit 2215701faa8b0f25ed306dda696915a1f8657a5a retains report SHA256 09d494e95a2758af953072511be3cdc33e2954afc2395fa72e6b91c17dd215eb, native owner audit SHA256 bfcb32df3fa0e4305aab8c49a4b641e1c3e207706e076b209842706b8c4779dd, and exact before/after snapshots. The coordinator independently verified those snapshots, physical response fields, exact Task-only mutation and both genuine issuer audits. Its owner readback reports Revenue all65 tables/catalog unchanged and both original stores absent, plus Delivery all8 G2 fact groups/capture/bind command unchanged with exactly one retained finalization/audit. Root retains and validates the canonical owner readback hashes separately.

Only the fresh local proof role was disabled after evidence retention: NOLOGIN/password cleared, zero own sessions, no retained role/PUBLIC change, and the exact post-proof business snapshot unchanged. proof-role-disabled.json SHA256 16d9901ec80594160f1101717ad3bb92b9244b877a1fd3b98f4f77a42dbcbb51 retains this cleanup. All old runtimes and actual histories remain preserved.

Completion of this local commitment does not close production ingress, compatible deployment, all-writer/sender coverage, production privileges, key custody, migration history or activation gates. The release owner must integrate the full prerequisite branch/source and migration chain, not only the5d8 commit. The new negotiation remains disabled by default; flag rollback preserves permanent history and never reopens retired Tasks or abandoned senders. ADR0052/0053 deadlines and ADR0048 activation remain unchanged.