Sales proposes a separately negotiated retired-original recovery variant

Draft for the sole canonical coordinator to publish. This position is not an ADR acknowledgment, accepted schema, implementation authorization, or production readiness claim.

Finding

Actual original 43a97f2f-391c-4cc7-9086-8ac620ad9290 was admitted before Delivery create. Sales retained the authentic raw201 and generation2 signed descriptor. Revenue then admitted the exact bind, recovered the lost successful bind reply, settled it, abandoned its continuation, and completed canonical financial writeback and Delivery G2 finalization. The provider boundary was never called. Revenue's retained original response is absent, rather than a lost terminal response.

The accepted observer supplies an obligation assessment only on original_terminal. Its unchanged pending branch is correct for this original even though compensation finalized. Sales must preserve the open original Task. It cannot manufacture a terminal HTTP result, treat an admitted bind as never-admitted, use a descriptorless no-send closeout, or infer retirement from G2 alone.

Endpoint and version position

Sales prefers a separately negotiated closed response variant on the existing authenticated recovery endpoint and request body. The exact scope remains revenue.sales-ordering.close.recover. Negotiation changes response grammar only and adds no authority. The existing endpoint retains its accepted same-original durable resume behavior. The eligible new retirement branch performs no provider call, new admission, compensation, financial writeback, or finalization CAS effect; exact replay of completed finalization may obtain a fresh observation. A separate endpoint would add routing, policy, and compatibility work without isolating a different business permission.

A separate endpoint is acceptable if owner review finds that observation negotiation cannot fail closed for older clients. It must carry the same exact original identity and proof, with no broad lookup or financial action permission. No endpoint or scope change is approved here.

Proposed negotiation, aligned with Revenue's draft and subject to joint owner decision: candidate Ordering package5.0.0, request and response header Sales-Ordering-Recovery-Observation-Version: 2.0. Omission continues to select the legacy observation grammar. The header is a single exact scalar; unknown, comma-joined or conflicting values fail before evidence disclosure. The response must echo the selected version. There is no fallback from a failed new-version read to retirement using older or incomplete evidence. Original request, descriptor, digest/normalizer versions, close key, and original identity protocol_version: 3.0 stay frozen. Package and observation versions are separate from original admission identity. A body selector would require another closed recovery request grammar; Sales prefers the scalar header to preserve the existing exact request.

Closed grammar requirements

The proposed new branch has exactly these top-level members:

{
  "protocol_version": "3.0",
  "observation_version": "2.0",
  "result": "original_obligation_retired",
  "identity": "Exact existing OriginalIdentity object",
  "original_response_absent": true,
  "obligation_assessment": "Full existing RetiredCompensation object"
}

The string placeholders above describe schema references, not wire values. Both referenced members must be objects with the existing closed definitions. Every object level denies additional members. All six top-level members are required. original_response, null or partial terminal bodies, and an invented success/error result are forbidden. Existing pending, original_terminal, and never_admitted grammars remain unchanged. The new variant is never emitted under legacy negotiation.

An ineligible candidate retains the existing legacy result and authorized same-original resume behavior under existing barriers. A permanently abandoned continuation cannot resume, including when retirement proof is unavailable. Proof unavailability leaves that original pending without reviving its continuation. The new branch never grants resume authority.

Revenue must prove an actually admitted registry/original association, absent original terminal result, irreversibly abandoned continuation, and no unresolved provider attempt, financial effect, or original work. Absence requires both registry.original_response and SchedulingBindIntent.response (the original Sales-facing financial continuation result) to be NULL. The genuine Delivery bind receipt and exact raw bytes remain required. NULL response fields alone prove none of the continuation, provider or retirement predicates. Unknown provider outcome stays pending even when some compensation facts exist. Existing current financial assessment, enforced execution barrier, association, compensation authority/receipt, canonical writeback, finalization command/result receipt, G1-to-G2 progression, and current finalization assessment remain mandatory. No boolean or local snapshot replaces these producer proofs.

Sales verifies the retained signed descriptor and original soft command/raw201 source; exact tenant, Organization, close key, request and descriptor digests; original Person and lesson; bind intent, Order and reservation; coach/site/service-area/type/participant/window; and every existing digest, revision, generation and chronology rule. It verifies original source identity directly, without requiring or inventing a terminal response. Current resource and financial observations must remain fresh within the accepted ten-second observation/commit budget, including subsequent owner reads, SQL locks, deferred checks and final local authorization.

The result permits only append-only retirement of the same unresolved original and atomic completion of its exact Task under the existing Lead/original/Task barriers. It does not create genuine success completion, a paid booking, customer handoff, new original identity, replacement key, or new admission permission. Existing no-send, never-admitted, compensation, clock-fault and original-success histories remain distinct. A source or authority mismatch leaves the original blocker intact.

Required vectors and actual proof

1. Positive admitted preprovider original, absent terminal response, abandoned continuation, exact fully finalized G2 proof, current authority, no unresolved original work; only the original retirement and Task completion change.
2. An authentic terminal original continues through the existing branch with byte-identical immutable response. An authentic pending original continues with no assessment under legacy negotiation. Never-admitted and descriptorless cases remain unchanged.
3. Missing, unsupported, conflicting or absent response-version echo; new result under legacy negotiation; unknown members; duplicate JSON keys; invalid UTF8/Unicode; excessive recovery, Delivery envelope or retained-result bytes; noncanonical base64 and altered exact UTF8 result bytes.
4. Wrong key/descriptor/request digest or Person/Organization/lesson/bind/Order/reservation/window association; stale, future or inconsistent current observations; invalid digest; revision regression/overflow; missing enforced barrier; G1/G2 mismatch; unpreserved finalization fence or contradictory original facts.
5. NULL terminal response with a protected or resumable continuation, active/unknown provider attempt, pending writeback/finalization, or unresolved genuine payment/refund work cannot authorize the new retirement branch. Existing authorized same-original recovery remains governed by its accepted barriers. Permanently abandoned originals with unavailable proof remain pending and cannot resume. Finalized compensation alone is insufficient.
6. Changed original source or Task, competing signing/send/completion/closure, lock delays, stream stalls and transaction failure cannot authorize partial retirement. Idempotent retry preserves the exact original and evidence; a failed attempt exports bounded nonsecret owner response evidence without credentials.
7. Actual same-database integration repeats current authenticated Revenue/Delivery/Platform owner observations, retains all original and finalization bytes, checks the exact Task and all local obligation effects, and proves zero new financial/provider/create sends. Model vectors do not substitute for this proof.

Owner asks and release gates

Revenue should supply the exact registry/continuation/provider predicate and closed new envelope. Delivery should confirm unchanged immutable compensation/finalization authority and current resource semantics. Platform should confirm whether unchanged path/scope needs any policy or nondisclosure amendment. Coaching should confirm the current G2 proof linkage remains unchanged. Sales will review their concrete grammar and vectors before acknowledging the proposed ADR.

The coordinator must select the exact observation version, publication and compatible producer/consumer writer barriers, planned cutover and maximum deprecation deadlines. Existing ADR0052/0053 deadlines are not reset or extended by this proposal. Rollback must disable the new variant or its consumer while preserving every original, finalization and retirement fact; the old client continues to retain this original as pending. No implementation or new financial fixture is authorized before the owner-reviewed disposition.

References

• Actual Sales package: docs/evidence/adr0054-owner-composition/third/signed-public-package.json, SHA256 5dcf7484e2280985347183e9ace0517e8ed3d276dc2ba156313cd7ad08581d86.
• Actual Revenue retained proof package: docs/adr0054/producer/evidence/third-retained-owner-proofs.json, SHA256 b05846fc1470d37665ed9e5c3a40f86d802d1948e3daa4fce58df38c7cc8cd1b, same original producer database revenue_adr0053_1ad1b37ef2fe4a1197b94c18e39f67c6.
• Actual finalization UTF8 response SHA256 5d79d9cab8118b9a358e3e616497eb6223c6e24ec4dc09c9e09c779bb5aeaea5 and finalization ID 5eb2fd15-a206-4143-88dd-0a2c888498e3.
• Existing Sales observer: modules/ordering-retirement/service.ts, modules/ordering-retirement/contracts/ordering-v3.schema.json, and sales-retirement-observer.schema.json.