Create Contract

Create a distributor contract for an enterprise client: contract terms, an attached library TOU, and one or more tiers, atomically (PRO-1981). The client's first contract also seats the named distributor admin; later contracts inherit the existing admin.

The named admin no longer has to be a user of the client already (PRO-3268). An address that resolves to nobody is provisioned here, as a Client Admin holding the Distributor Admin role, so the account cannot exist (and cannot be signed into) before the contract that justifies it. It is invited as it is created: the ordering is what keeps the admin out early, so once the contract exists there is nothing to gain by holding the invite back. Naming a user who does already exist is unchanged: they are granted the role by the create itself, and nothing is provisioned.

Order matters both ways. Anything that would stop the provisioning is checked before the contract is written, so a rejected admin leaves no contract behind; the account itself is created after, so a rejected contract leaves no account behind. Between the two, the decision is taken again under the client's create lock, because that first read happened before anything was serialized: see resolve_admin_to_provision for what the second pass settles (a concurrent duplicate, and a replayed form carrying a different address).