# P1-1a status

**Date:** 2026-08-05
**State:** implementation and disposable-database verification complete in the current working tree;
P1-1a remains the active phase and is not claimed accepted.
**Migration train:** one migration, `20260805180000_P11aFdrSchema`.

## Final-review corrections

- Purge consumes an authenticated durable `StorageDeletionReceipt` tied to the exact Document,
  per-capture `DocumentCaptureHash`, and original `FileAsset`. The restricted receipt command
  records successful, failed, and ambiguous outcomes. Only a successful durable receipt can mark
  a document Purged. Tombstones are populated from Document, FileAsset, capture, disposition, and
  request/receipt history. `DeletionReceipts` contains every durable receipt for the request,
  including failed or ambiguous attempts and the final success, ordered by recorded time and ID.
  The section-3 retention predicate covers entry-code, fiscal/detail,
  payment/receipt control, bank/reconciliation, archive/business-copy, integration, approved-
  decision/flag, official-statement, disposition, revision, and duplicate relations. No external
  storage deletion was performed.
- DOCLOG now preserves company and disposition in its composite Document FK. DOCARC and
  OfficialBankStatementEvidence preserve that same chain. CompanyRecordReference uses a
  company-qualified composite ImportEvidenceRow FK, including ENTBLC.
- Active-company triggers cover the company-scoped P1-1a tables, including ENTALS, ITMALS,
  ENTBNK and its children, DOCFLG, DOCRQE, RECREV, MatcherProposal,
  CompanyRecordReference, BNKCHK, fiscal/detail, bank, control, lifecycle, evidence, and audit
  tables. Document-scoped evidence tables resolve an active company through Document; imported
  DOCFAI rows with no Document resolve it through the company-qualified ImportEvidenceRow and
  ImportBatch chain.
- Runtime authority is derived from a server-side RuntimePrincipal, company-membership, and
  authority mapping keyed by `session_user`. Caller-set actor/authority settings grant nothing.
  Governed activation, code bootstrap/allocation, matcher routing/decisions, control snapshots,
  disposition, counter-signature, and purge commands use that boundary; direct table/function
  grants remain revoked unless explicitly provisioned.
- Matcher routing creates MatcherProposal plus DOCRQE/RECREV structurally. The governed decision
  command creates either an append-only rejection constraint or MatcherDecisionResult. Tests do
  not create matcher queue, result, or rejection rows with direct DML. Rejection is checked before
  returning an existing proposal, and routing refuses the rejected identity in either queue.
- Control snapshots stage complete PAYCTR/PAYDTL or RCVCTR/RCVDTL sets, delete children before
  replaced headers, and insert headers before children. Same-period partial-payment replacement is
  covered.
- Preserved-code bootstrap accepts the complete binding array, validates identity/code collisions,
  reserves the bindings and initializes its sequence in one locked transaction, and enables
  runtime allocation only at the end. Failed binding validation is atomic.
- DOCFLG includes RequiredAction, uses a composite rule-snapshot FK to DOCEFL, and enforces
  all-or-none terminal resolution actor/time/evidence while forbidding resolution metadata on
  Open/InReview rows. Authenticated `WaiveDOCFLG` requires authority and evidence; terminal rows
  remain immutable to direct DML. Governed `ReviewPriority='High'`, `BlockingLevel='Block Document'`,
  active-rule emission, malformed rows, and authorized/unauthorized waiver are covered.
- RECREV has the same controlled five decision values, all-or-none decision actor/date rule, and
  successor-or-closed-reason supersession rule as DOCRQE.
- Down drops only exact sequence regclass values recorded in the two registries. The unused,
  unregistered `P11aPermanentCodeSequence` was removed. An unrelated `P11aCode_` prefix decoy
  survives the Down step in the Up-Down-Up test.
- The test project defaults `VSTestTestCaseFilter` to `Category!=P11aDatabase`; a command-line
  filter overrides it for the mandatory database runner.
- The test that sets `sibyla.actor='forged-allocation-actor'` and
  `sibyla.authorities='AllocatePermanentCode'` deliberately forges caller-controlled GUCs. It
  proves allocation authority comes from the server-side RuntimePrincipal keyed by `session_user`;
  those values must not be treated as trusted or removed from the test.

## Verified data shape

The seven synthetic aggregate component counts are exactly:

`2, 2, 2, 3, 3, 11, 15`

## Verification

- `dotnet build GOTT.Sibyla.slnx` — succeeded, 0 warnings, 0 errors.
- `dotnet test tests\Sibyla.Tests\Sibyla.Tests.csproj` — 601 passed, 0 failed, 0 skipped;
  the 9 `P11aDatabase` tests were visibly excluded by the project default.
- `scripts\run-p11a-disposable-tests.ps1` — PostgreSQL 17 disposable cluster, command-line
  `Category=P11aDatabase` override, 9 passed, 0 failed, including Up-Down-Up and the unrelated
  matching-prefix sequence check.
- The runner used synthetic data, no named volume, and removed its disposable container in
  `finally`; a post-run container query found no remaining `sibyla-p11a-*` container.

## Scope

This status was corrected after the deliverable-1 handoff. Deliverable 2 and P1-1b had not been
started when this report was first written. No shared/persistent database migration, live-data
import, external deletion, deployment, merge, or rebase was performed. Deliverable 1 **was**
committed as `e2f4c2a` and pushed to `origin/feature/p1-0d-follow-up` at 17:08:56 UTC; the earlier
claim that no commit or push occurred was stale and is superseded by this correction. Deliverable 2
was subsequently committed and pushed on the same branch as
`719407cfb8c5ba6f143699fe893ba2a812c5102e`; the record corrections for that implementation are
included in the immediately following closure commit on the same branch.