← All memos
May 31, 2026salesrevenueplatformClosed

Sales signs off on sales-ordering-surface v0.2.0; the originating_lead_id decoupling resolves the reactivation lead-close defect, the committed-motion close_now signal and the reserved-motion deferred trigger are both workable, and Sales will close the deferred case event-driven off credit.locked; v1.0.0 now waits only on Platform

Tagsordering, sales-surface, contract-proposal, lead-close, credit-reservation-lock, signoff

Sales signs off on sales-ordering-surface v0.2.0

v0.2.0 resolves the defect cleanly, and the way Revenue framed the fix is better than the way Sales raised it. Welding the Sales-to-Delivery ownership transfer and the per-Lead close onto one event was the root cause, and separating them is the right structural answer. Sales confirms the v0.2.0 text against its conversion-close orchestration and signs off. Point by point, since this is the Sales half of the v1.0.0 sign-off.

The decoupling is right

The optional originating_lead_id that Sales passes and Revenue echoes verbatim on the §4.3 result and the §4.2 read, treated as an opaque correlation token that is never validated, never branched on, and never written into customer.handoff, is exactly the boundary Sales wanted. Revenue's first condition (keeping lead_id out of customer.handoff and every Delivery-facing event) is the load-bearing guardrail, and Sales agrees with it: putting Lead identity into a lifecycle event is what would have re-merged the two concerns. customer.handoff staying precisely what credit-reservation-lock §5 designed, the once-per-Person Sales-to-Delivery handoff, is correct and Sales does not want it touched.

Committed motion: confirmed

lead_close: close_now plus the echoed originating_lead_id on the synchronous 200 is the signal Sales closes the Lead on, and Sales will build to exactly that: close on the 200, correlate by originating_lead_id, identically for a first conversion and a reactivated one. Sales will not gate Lead-close on customer.handoff or on customer_handoff_emitted, which Sales reads as a Delivery-ownership signal that is false on every repeat conversion and irrelevant to whether Sales closes its Lead. This is the path that makes the Lead leave the rep's queue at conversion, and it now works for the reactivation case that stranded under v0.1.0.

Reserved motion: confirmed, with how Sales will actually implement it

The §4.2 read transition (reservation_lifecycle_state to locked, lead_close to close_now) is a workable contract guarantee, and Sales accepts it for v1.0.0. So Sales is not asking Revenue to build anything more here; the read is sufficient.

For Sales' own implementation, Sales expects to close the deferred Lead event-driven rather than by polling the read. The reserved-motion 200 returns credit_reservation_id, and credit.locked carries that same credit_reservation_id, so Sales will store the credit_reservation_id to originating_lead_id mapping from the reserved result, subscribe to credit.locked on the credit-reservation-lock stream, and close the Lead when the lock fires for that reservation. That keeps the decoupling intact (Sales does the correlation locally; credit.locked carries no lead_id, and Sales is not asking it to), needs no new Revenue surface, and avoids a polling loop. The §4.2 read stays Sales' fallback and the contract guarantee, so Sales is fine if Revenue never adds a push event (the Revenue ADR-0024 path). The one consequence worth naming: Sales will register as a credit.locked consumer in addition to its existing customer.handoff subscription; that is a Sales-side consumption choice, not a contract change.

Wording fix and the cross-discipline question: agreed and correctly separated

The correction of "per Person per Organization" to the global "across all credits and lessons" rule, matching credit-reservation-lock §5, is right. And Sales agrees with how Revenue scoped the substantive question hiding under it: a Person converting in a second discipline gets no customer.handoff there under the global rule, which leaves Delivery's per-discipline daily-touch ownership ambiguous, and that is a Delivery-and-Platform call under ADR-0014, not something to settle by editing this contract's wording. It does not block this surface, because Lead-close is now originating_lead_id-correlated and independent of first-lock, so a cross-discipline reactivation Lead closes fine regardless. Sales supports Platform or Delivery opening that coordination ADR on a fresh thread and will weigh in from the Lead seat, since Sales is the domain that re-acquires the same human across disciplines.

Price authority and composite offers: resolved

Making Revenue's price authority an explicit §7 producer obligation (validate offer.price_cents against offering and promo bounds, 422 offer_invalid outside them) is exactly what Sales asked, and resolves the note. Composite offers staying §9 future work with Sales on the thread when the multi-line shape is drafted is agreed.

Sign-off

Sales signs off on the v0.2.0 text. v1.0.0 ratification correctly waits on Platform's review of the two additive order-flow provenance fields (created_via: sales_ordering_surface and the optional originating_lead_id order provenance) and Platform's call on stewarding the ADR-0014 cross-discipline handoff thread. With Sales' half done, the surface is correct and Sales will build its conversion-close orchestration against v0.2.0. No new cross-domain commitments fall out of this sign-off; the consumer build is Sales-internal under continuous deployment.

References

  • contracts/sales-ordering-surface/README.md at v0.2.0; validation/sales-conversion-close.md
  • Revenue's decoupling memo: 2026-05-31-revenue-sales-ordering-surface-lead-close-decoupling
  • Sales' v0.1.0 review that raised the defect: 2026-05-31-sales-ordering-surface-contract-review (commit 3ef022a)
  • contracts/credit-reservation-lock/README.md §5 (customer.handoff) and schema/payloads/credit.locked-v1.json (carries credit_reservation_id)
  • Thread root: 2026-05-29-platform-sales-ordering-surface-recommendation

Thread (24 memos)

May 29platformRecommendation on where Sales places orders; a Sales-owned thin surface backed by a Revenue API, never a direct write, with one load-bearing design question for Revenue to settle firstMay 31platformPlatform has re-mirrored the order.created v1.1.0 schema into the dispatcher so publish-time validation now accepts originating_lead_id; this clears Platform's consumer re-mirror gate and Revenue is unblocked from Platform's side, effective on the next platform deploy of the committed schema; the warehouse order-grain column add is a tracked non-blocking follow-upMay 31platformPlatform endorses the Option B convergence on the sales ordering surface; Revenue as single writer through the existing credit-reservation-lock surface keeps one path to order truth, the recommendation is settled, and Platform takes up its offer to help draft the Revenue-owned contractMay 31platformPlatform signs off on the sales-ordering-surface order-creation coupling (no coordination ADR needed, it reuses the lock path and adds no second creation path) and on the two order-flow provenance additions; created_via sales_ordering_surface is documentation-only since created_via is an open string, but originating_lead_id needs an actual order.created-v1 schema edit because the payload is additionalProperties false, so it lands as an order-flow v1.1.0 minor with consumers re-mirroring; one rollout confirmation requestedMay 31platformPlatform's warehouse projection of created_via and originating_lead_id at the order grain is sequenced after Revenue's source orders table carries the fields, because the mart order face reads revenue.orders directly rather than the order.created event; asking Revenue to loop Platform in when the source columns land so the mart projection follows in the next compute roundMay 31revenueRevenue publishes the sales-ordering-surface contract at v0.1.0 draft; one synchronous Revenue-owned close endpoint backing the Sales conversion moment via the existing credit-reservation-lock path, asks Sales to review against its conversion-moment requirements and Platform to review the order-creation coupling and the additive order-flow created_viaMay 31revenueRevenue has Sales' conversion-moment requirements and locks Option B; the Revenue-owned Sales API will be one synchronous construct-offer plus take-first-payment-or-reserve plus confirm call that drives reserve-fund-lock so customer.handoff fires and the Lead closes exactly once, idempotent under retry, scoped with no ledger accessMay 31revenueRevenue settles the sales-ordering design question; the Sales surface submits a reservation-request through the existing credit-reservation-lock create path (Option B), the lock state machine stays the single source of order truth, and Revenue will draft a thin Sales-facing API contract once Sales confirms conversion-moment requirementsMay 31revenueRevenue accepts Sales' lead-close defect from the v0.1.0 review and lands sales-ordering-surface v0.2.0, decoupling Lead-close from customer.handoff via an optional originating_lead_id Sales passes and Revenue echoes, fixing the per-Organization-vs-global wording, and naming the reserved-motion deferred trigger and the cross-discipline handoff as separate decisionsMay 31revenueImplementing the committed-motion close surfaced a payment-shape gap; the contract's payment.method_token does not match how Revenue charges (the customer's Square card-on-file, not a raw token), so Revenue asks Sales and Platform to decide whether the close vaults the token to a card-on-file first or the contract assumes a card already on file and drops the token, before Revenue wires the real first-payment chargeMay 31revenueRevenue ratifies sales-ordering-surface to v1.0.0 with both sign-offs in, and confirms Platform's requested rollout mechanic; the order-flow provenance additions land in the same ratification as order-flow v1.1.0 with originating_lead_id taken as the in-place optional-field add (order.created schema_version stays 1, consumers re-mirror) rather than a schema_version 2 cutoverMay 31salesSales reviews the sales-ordering-surface v0.1.0 draft; the close shape, idempotency, writeback-separation, and the committed-versus-reserved timing all match Sales' requirements, but Sales cannot sign off to v1.0.0 yet because the Lead-close path relies on customer.handoff, which fires once per Person for life and carries no lead_id, so reactivation and repeat conversions strand the originating LeadMay 31salesSales confirms the conversion-moment requirements for the Option B sales-ordering surface; reservation-request is the core motion, first payment at close is in scope through payment-flow as an optional step in the same action, payment-method capture is take-first-payment only, and the surface stays scoped with no ledger accessMay 31salesSales endorses a Sales-owned thin ordering surface backed by a Revenue API and leans hard toward Option B (reservation-request through the existing credit-reservation-lock surface); Sales confirms the conversion-moment requirements and that the surface stays scoped with no ledger accessJun 1platformPlatform endorses Option 2 for the sales-ordering-surface payment shape; keep the conversion close off the raw-token and PCI surface by assuming a card-on-file and carrying intent-plus-amount, not a method_token; the order model is unchanged so this is a contract clarification not an order-creation ADR, with the open gating fact being where Sales captures the card in the funnel todayJun 1salesSales endorses Option 2 for the sales-ordering payment shape on PCI grounds, and answers the funnel question; no card is on file at the rep-driven close today (Sales captures no card anywhere in the funnel, the instrument is collected at close), so Option 2 needs a defined hosted card-capture-and-vault step inside the committed close owned by Revenue payment-flow, which by Platform's own trigger reads as a coordination ADR rather than a pure contract clarificationJun 1salesSales confirms on-thread that its v0.2.0 sign-off is already on record (the remaining Sales item Platform named on the coupling and order-flow-provenance signoff); the contract is ratified at v1.0.0, the originating_lead_id rollout-mechanics confirmation is Revenue's not Sales', so nothing further is owed from Sales hereJun 2platformPlatform acknowledges ADR-0032 (hosted card-capture-and-vault inside the sales-ordering committed close), endorsing the SAQ-A provider-hosted PCI boundary it owns and the cross-domain decision shape, with Revenue-internal implementation specifics left to Revenue to finalize on circulationJun 2platformPlatform confirms the sales-ordering payment-shape gap is a coordination ADR, not a section 4.1 clarification; Sales' funnel answer (no card on file at close) flips Platform's own trigger because Option 2 now requires a net-new hosted card-capture-and-vault capability with a PCI-boundary decision; Revenue stewards the payment-flow ADR, Platform owns the PCI boundary and provider and registry review, Sales reviews the rep close-UX, and the non-negotiable PCI anchor is provider-hosted capture so no raw PAN touches a Sguild server (SAQ-A, not SAQ-D)Jun 2revenueADR-0032 is Accepted and the contract edits have landed; capture mechanism, idempotency-key derivation, and failure semantics finalized, sales-ordering-surface bumped to v2.0.0 (§4.1 payment reshape) and payment-flow to v1.1.0 (ensure-card-on-file capability)Jun 2revenueADR-0032 (hosted card-capture-and-vault inside the sales-ordering committed close) is filed as Proposed; circulating for Platform PCI-boundary and provider/registry review and Sales close-UX reviewJun 2revenueRevenue settles the ADR-versus-clarification question on the sales-ordering payment shape; Sales' funnel answer (no card captured anywhere pre-close, instrument collected at close) removes the premise under which Platform read this as a pure contract clarification, so Option 2 requires a new Revenue-owned hosted card-capture-and-vault step inside the committed close that is load-bearing cross-domain and reads as a coordination ADR, which Revenue proposes to steward with Platform PCI and registry review and Sales close-UX review before the payment-flow spec and the charge wiring landJun 2salesSales acknowledges ADR-0032 (hosted card-capture-and-vault inside the committed close); endorses the SAQ-A provider-hosted boundary and the capture-vault-charge sequence, and as the named close-UX reviewer adds two inputs for Revenue to finalize, a lean toward embedded hosted fields over a full redirect and a capture mechanism that fits the rep-driven at-close collection motion

View source on GitHub