# P1-1a remote pre-review — findings report

**Date:** 2026-08-05 · **Reviewer:** remote review session (independent of the implementing agent)
**Scope:** the P1-1a set on `feature/p1-0d-follow-up` — `e2f4c2a` (deliverable 1, structural
review), `719407c` (deliverable 2, deep review), `74d8635` (closure records) — plus
`docs/p1-1a-d2-status.md`, the d2 base prompt, Amendment 1, and the closure prompt.
**Limit of this review:** conducted from the repository files and git history only. **No build or
test suite was re-run** — this session cannot execute .NET or the disposable-PostgreSQL runner.
The verification numbers (28/28, 629/629, 10/10, 0 warnings, 0 containers) are therefore
*verified as claimed and as consistent with the test code present*, not independently reproduced.
Reproduction is assigned to the on-machine reviewer via `docs/AGENT-PROMPT-v5-P1-1a-review.md`.

## 1 · Repository-state claims — all verified against git

| Claim | Verified |
|---|---|
| `74d8635` on `feature/p1-0d-follow-up`, single parent (`a276ca3`), no merge/rebase | ✔ `git cat-file -p` |
| Local = upstream = remote SHA; divergence 0/0; working tree clean | ✔ `git status -b --porcelain`, `git rev-parse origin/…` |
| Closure commit touches exactly the four record files | ✔ `git show --name-only` |
| Commit body: 7 real lines, zero literal `\n` sequences | ✔ `git log -1 --format=%B` |
| `719407c` contents: validation service + snapshot source + 3 test files + 4 record files, 1,561 insertions | ✔ `git show --stat` |
| No history rewrite; `e2f4c2a` unchanged with its recorded `\n` defect | ✔ log inspection |

**Topology deviation, disclosed and acceptable.** The closure prompt ordered *one* commit
containing the d2 diff plus the record corrections. In fact `719407c` was already committed and
pushed (by prior instruction) when the closure prompt arrived, so the agent preserved it and made
`74d8635` records-only. This violates the closure prompt's letter, complies with its no-rewrite
constraint, and was disclosed rather than papered over — both status files state the two-commit
topology explicitly. Recommended disposition: accept as a recorded deviation; the on-machine
reviewer should countersign that acceptance in the sign-off.

## 2 · Deliverable 2 — check-by-check cross-review

All sixteen checks in `RegistryValidationService.cs` were compared against the table in
`docs/p1-1a-d2-status.md` and their cited sources. **The implementation matches the documented
check set; no invented check was found; no documented check is missing.** Points verified:

- **C9 scoping is correct and narrow.** `Source <> 'BNK'` filters exactly three checks (standalone
  filename uniqueness, DOCTYP coverage, DOCTYP placement). DocumentType-presence, Flag↔Category,
  CaptureQuality, orphan and bijection remain unscoped, as specified.
- **Bijection is global and two-directional** (pair→codes and code→pairs), and the prohibited
  one-EntryCode/one-code shortcut is not implemented. The disposable test proves two BNK rows may
  share a filename under different EntryCodes without weakening it.
- **Warnings vs failures are as decided:** synthetic FiscalNo, CaptureQuality, orphan-DOCLOG are
  warnings (orphan input retained); everything else including DOCEFL seed-completeness is a
  failure. The DOCEFL check asserts the exact `EF0000001`–`EF0000045` manifest, `Imported=true`,
  no unexpected imported codes, and all fourteen P1-0e-nullable fields present on imported rows.
- **The FX triplet is `(Period, From, To=EUR)`**, matching the resolved `build_lookup_tables`
  citation, with a disposable test proving the wrong quote direction fails.
- **Authorization is the application principal**, exactly as the second adversarial round
  specified: single unambiguous `sub` (then `NameIdentifier`) → active `UserProfile` → active
  `Membership` → active `CompanyRegistry`, byte-exact (`convert_to`) subject and company-code
  comparison, ambiguity fails closed. Cross-company denial, case-mismatch denial,
  inactive-user/membership/company denial, and the SELECT-only non-owner role are all covered by
  the disposable test.
- **Failure is fail-closed everywhere observed:** unauthenticated context short-circuits before
  data checks; an unavailable/unauthorized source marks *every* data check failed rather than
  returning an empty clean run; unknown Treatment/ProcessingRoute literals throw on
  `Enum.Parse(..., ignoreCase: false)` and land in the same fail-closed path.
- **Payables = `FlowType='I'`** is consistent with the schema mapping (`I|R|P|F|O`; payables
  import `ProviderCodeName`, receivables `EntityCodeName`; bank-generated are `P|F|O`).
- **ENTMST resolution uses the transaction-derived population** (FDCHDR counterparty ∪ FDCDTL
  CodeNames), so a foreign company's rows cannot influence the report — proven in tests.

## 3 · Advisory findings — none blocking, none requiring re-work before sign-off

- **A1 · Misleading diagnostic on vocabulary violations.** An unlisted `Treatment`/
  `ProcessingRoute` literal fails closed (correct) but is reported as "registry source was
  unavailable", which mislabels a data-integrity finding as an infrastructure problem. Cosmetic;
  worth a P1-1b-era refinement, not a change now.
- **A2 · Filename uniqueness is byte-exact (`Ordinal`).** `Invoice.PDF` and `invoice.pdf` count
  as distinct. The prototype ran on a case-insensitive filesystem; if its uniqueness notion was
  case-insensitive, this is a subtle scope difference. The on-machine reviewer, who has the pinned
  prototype, should confirm which semantics §15 implies and record the answer either way.
- **A3 · Header/detail reconciliation is O(headers × details).** Irrelevant at synthetic scale
  and fine at the 2026-history scale (~1,100 headers); flag only if the corpus grows by orders of
  magnitude.
- **A4 · `CorrelationId` is required but not yet emitted anywhere.** Presumably wired later to
  logging/audit; note so it is not forgotten.
- **A5 · Convenience defaults on a production record** (`RegistryDocLogRow.DocumentState="Posted"`,
  `DocumentId=""`) exist for fixture ergonomics. Harmless today; the PostgreSQL source always
  supplies both.

## 4 · Closure records — consistent

The four corrections in `74d8635` match the closure prompt's ordered list and the git facts they
describe. `PROJECT-STATE.md` closes O6, registers O7 (CaptureQuality — Miguel, non-blocking), and
adds the two changelog rows; `project-todo.md` ticks the three items with the Amendment 1 §4
annotation and marks the session-derived counts indicative; both status files state the two-commit
topology. No contradiction between any record and git was found.

## 5 · Recommendation

**Accept, conditional on the on-machine reviewer reproducing the verification numbers** (build,
629-test suite, 28-test focused suite, 10-test disposable-PostgreSQL runner, 0 residual
containers) **and dispositioning A2.** Nothing found in this review blocks sign-off; the advisory
findings are recorded for the P1-1b backlog, not as acceptance conditions. Sign-off should state
explicitly that it does not authorize P1-1b imports, shared/persistent-database migration, or
production deployment (O5 still gates production).