---
title: Month-End Close Design Examination
examined_at: 2026-10-23
examiner: codex
branch: agent/accounting-close-desi-exam-1
source_sha:
  services-accounting: f47cb263875bbc0c5640fba7dae6785ec32695f8
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
starting_corpus_sha: ab9a9248239614a39a54bdb150c6df762fd3193e
evidence:
  - specs/CONVENTIONS.md, sections 6 and 9; specs/templates/{DOMAIN-OBJECT,STATE-MODEL,WORKFLOW,SERVICE-CONTRACT,SCREEN-CONTRACT,DECISION-RECORD,RESPONSIBILITIES,INFERENCE-OPERATION}.md
  - specs/accounting/close/MODULE.md, planning/{capabilities,concepts,journeys,acceptance,features}/, FINDINGS.md
  - services-accounting:modules/fiscal-close/**; aws/accounting.service.ts
  - services-accounting:docs/fiscal-close/**; docs/migrations/fiscal-close/**; docs/architecture/accounting-2.0/** (close claims)
  - services-accounting:docs/milestones/plans/ACCT-M4-plan.md, rows 73–78, D8 and D12; docs/milestones/ACCT-M4-contracts-and-events-for-commerce.md
  - services-accounting:modules/batches/services/posting-period-guard.ts; modules/batches/services/persistence/batches.ts
  - services-accounting:modules/maintenance/services/participants/fiscal-close-participant.ts; configuration-participant.ts
  - react-console:app/(console)/console/[tenantId]/accounting/close/**; components/accounting/close/**; lib/accounting/close/**
  - react-console:components/console/page-layout.tsx; lib/layout/page-width.ts (imported layout dependencies)
unavailable:
  - briefs/design/accounting-close.brief.md at the starting corpus commit
  - Platform implementation of lifecycle dispatch and durable-job reconciliation
  - Record registration capabilities.customFields declarations
  - Authoritative R2-ARCH-001 and R2-ARCH-002 source records
counts:
  design_artifacts: 34
  domain_objects: 4
  domain_invariants: 40
  state_models: 2
  state_model_invariants: 13
  lifecycle_states: 9
  transition_rows: 13
  workflows: 8
  workflow_hops: 38
  service_contracts: 1
  operations: 10
  job_event_types: 6
  job_kinds: 2
  screen_contracts: 5
  decision_records: 14
  responsibility_module_rows: 1
  distinct_source_and_anchor_values_after_verification: 124
  new_findings: 12
  new_open_questions: 0
  inference_operations_required_by_observed_calls: 0
verification_commits:
  - c910df9
  - 1f2c253
  - ffbbcdd
validation:
  acceptance_command: npm ci && npm run check
  conformance_errors: 0
  test_command: npm test
  tests_passed: 4
  tests_failed: 0
  source_integration_tests_executed: false
---

# Month-End Close Design Examination

## Examination Basis

This examination compared the complete close design with the pinned implementation and its planning layer. The review opened cited files, functions, route declarations and named tests, then traced their callers, transaction boundaries, database constraints and screen rendering. Cited tests were read as evidence; the accounting integration suite was not executed, so the concurrency findings identify missing guarantees rather than reproduced failures.

The final text of every design artifact and the close responsibility section was rewritten by Codex. Verification changes were committed before rewriting, and each design artifact’s rewrite has its own commit. Existing identifiers, approval states and product decisions were retained. The planning layer was left unchanged, and contradictions were recorded for its owner.

The requested drafting brief was absent. External architecture standards, registration declarations and Platform orchestration implementations could not be verified from the available sources. Their limitations remain explicit findings rather than inferred approval.

## Coverage

| Subject | Coverage | Qualification |
|---|---|---|
| Declared close operations | 10 of 10 in the service contract | Access, action permissions, realization references and unpublished Submissions reasons checked against declarations. |
| Close-owned physical tables | 8 of 8 in domain objects | Seven run and execution tables belong to the run object; the immutable snapshot belongs to the close record. |
| Shared calendar and policy storage | 3 of 3 named dependencies | Years, periods and settings are described without claiming ownership of the entire shared records. |
| Console pages | 5 of 5 in screen contracts | Shared layout, provider, adapters, rendering, action controls and confirmation components checked. |
| Execution machines | 2 of 2 in workflows | Close and reopen sequences include failure handling, retry limits and retained inconsistent state. |
| Module-owned queues and schedules | None declared | Imported Platform dispatch and reconciliation are not verified as owned infrastructure. |
| Lifecycle callbacks | Export and purge covered | Local callbacks and deletion dependencies are supported; external dispatch and retry behavior remain unknown. |
| Model calls | None found in the close module | All fourteen service, workflow and screen contracts retain empty inference arrays; no inference artifact was required. |
| Planning concepts and design objects | 4 concepts, 4 objects | Readiness remains a calculation with retained run and snapshot evidence rather than a separate persistent record. |
| Decisions and responsibilities | 14 decisions, 1 module row | Confirmed intent remains tied to its cited product origin; observed departures do not acquire approval. |

## Changes by Artifact

Every row below also received final prose, including its structured descriptions and explanatory sections. Artifact identifiers serve as the examination ledger.

| Artifact | Verification outcome and correction |
|---|---|
| DOM-ACC-CLS-001 | Named both calendar tables. Replaced the claim of guaranteed neighbouring-month ordering with observed sequence validation and unlocked neighbouring reads. Marked custom-field registration unknown. |
| DOM-ACC-CLS-002 | Named policy, run and snapshot storage accurately. Distinguished calculated readiness from retained evidence and marked registration unknown. |
| DOM-ACC-CLS-003 | Removed database enforcement from the request-freezing invariant: the note is not frozen and minimum reason length is enforced above storage. Limited financial atomicity to work and run output, with events and calendar work separate. Marked registration unknown. |
| DOM-ACC-CLS-004 | Corrected audit-trail assembly to request/completion groups rather than a globally sorted timeline. Marked registration unknown. |
| STATE-ACC-CLS-001 | Clarified permitted system reversal, separate reopen history append, replay without locking and unlocked sequence reads. |
| STATE-ACC-CLS-002 | Corrected the queued-failure path, finalization guard and pre-lock failure-handler read. Removed the implied guarantee of neighbouring-period serialization. |
| WF-ACC-CLS-001 | Rebound the lock hop to its implementation function. Qualified replay, calendar generation, aging contention and external reconciliation delivery. |
| WF-ACC-CLS-002 | Separated successful reopen work from its later history event and qualified neighbouring-month concurrency. |
| WF-ACC-CLS-003 | Verified retry, current-job handling and retained progress. Rewrote recovery wording without adding a guarantee to the failure callback. |
| WF-ACC-CLS-004 | Distinguished failed-run console cancellation from direct queued-run cancellation. Retained refusal after committed recognition and atomic cancellation history. |
| WF-ACC-CLS-005 | Verified the evaluator, authorization coupling, check effects and read-only calculation. Retained the disabled bank-verification default and open product questions. |
| WF-ACC-CLS-006 | Replaced a batch-creation test citation as proof of posting with the observed posting guard. Recorded the planning disagreement about protected batch creation. |
| WF-ACC-CLS-007 | Described the local export callback as synchronous. Marked external dispatch and retries unknown instead of asserting a queue. |
| WF-ACC-CLS-008 | Described the local purge callback and its dependency declaration. Marked lifecycle dispatch and retry behavior unknown. |
| SVC-ACC-CLS-fiscal-close | Verified all ten operation declarations and six local event names. Corrected the domain/event/calendar commit boundaries and recovery qualifications. |
| SCR-ACC-CLS-001 | Corrected live all-closed errors, missing holding-run navigation, Full layout and close/reopen Dialog patterns. |
| SCR-ACC-CLS-002 | Corrected invalid-period handling and Full layout. Distinguished page validation from the stricter API period range. |
| SCR-ACC-CLS-003 | Verified final-month review and authority/sequence behavior; corrected Full layout. |
| SCR-ACC-CLS-004 | Recorded the adapter’s twenty-page history limit, conditional reopen target, tab pattern and Full layout. |
| SCR-ACC-CLS-005 | Removed the claimed standalone binding-readiness display. Corrected recovery button gating, cancellation availability and Full layout. |
| ADR-ACC-CLS-001 | Verified closing-field ownership separately from calendar ownership. |
| ADR-ACC-CLS-002 | Verified durable request/job separation and retained the approved product origin. |
| ADR-ACC-CLS-003 | Verified locked revalidation while preserving the viewer/system authorization disagreement. |
| ADR-ACC-CLS-004 | Qualified cross-month isolation and shared aging contention; separate row locks do not prove complete independence. |
| ADR-ACC-CLS-005 | Preserved the approved requester-conflict ruling and described the observed omission as a departure. |
| ADR-ACC-CLS-006 | Corrected the finite aging wait: exhaustion can fail closure. Preserved the conflict with the approved nonwaiting direction. |
| ADR-ACC-CLS-007 | Clarified that failed reopen can retain already-reversed revenue while the month remains protected. |
| ADR-ACC-CLS-008 | Removed an unsupported rationale for rejecting one calendar-generation transaction. Described separate yearly commits and replay limits. |
| ADR-ACC-CLS-009 | Distinguished omitted job events from warning and failure data retained in exported run outputs. Removed an inferred historical rejection of record-history capture. |
| ADR-ACC-CLS-010 | Distinguished absent custom-field storage and inputs from an unverified registration declaration. |
| ADR-ACC-CLS-011 | Removed the claim that the direct API requires console review. Kept publication rationale separate from observed publication absence and the unavailable standard. |
| ADR-ACC-CLS-012 | Verified workspace action grants without inventing business-unit permission scope. |
| ADR-ACC-CLS-013 | Verified system execution authority; the open requester-recheck question remains open. |
| ADR-ACC-CLS-014 | Verified shared deployment ownership and preserved the open dedicated-deployment decision. |
| RESP-ACC, close row | Replaced a descriptive event placeholder with the six service event names. Rewrote boundaries and guarantees with the transaction and concurrency qualifications. |

## Evidence and Metadata Corrections

The period sequence invariant now has observed provenance and cites its sequence validator. The financial-step invariant now has observed provenance and cites recognition implementation. The run request-freezing invariant no longer lists database enforcement. The close lock hop now cites its actual implementation with observed provenance, and the posting hop cites the posting guard with observed provenance.

The first export and purge hops now describe synchronous local callbacks; their external dispatch provenance is unknown and cites the lifecycle finding. Each object adds an unknown custom-field registration declaration. Screen source descriptions now identify bounded history and actual run rendering; screen evidence additionally names the imported layout default and confirmation components. Existing anchors remain available even where they support only the local callback rather than external orchestration.

No source commit, operation identifier, permission key, artifact identifier, product-origin value, implementation-evidence value or design-intent value was changed by the final-text pass. Decision titles and descriptive cardinality wording were rewritten without changing relationships. The identifier ledger allocates the twelve findings and corrects its already-used actor allocation range; no identifier was renumbered or reused.

## Findings and Open Disagreements

| Findings | What remains to resolve |
|---|---|
| FND-ACC-CLS-045–046 | Commit boundaries and actual database enforcement are narrower than the draft claimed. Corrections are complete; stronger behavior requires an implementation change. |
| FND-ACC-CLS-047–048 | Neighbouring-month ordering and stale failure-handler reads need concurrent proof or stronger locking and refresh behavior. |
| FND-ACC-CLS-049–050, FND-ACC-CLS-055–056 | Recovery visibility, history truncation, audit ordering and screen patterns now reflect the implementation; product changes remain separate work. |
| FND-ACC-CLS-051 | The planning finding that permits protected batch creation conflicts with the pinned creation guard and test. Its owner must reconcile that planning evidence. |
| FND-ACC-CLS-052–054 | Platform orchestration, record registration and the absent drafting brief remain examination limits. |
| Existing findings and five open questions | Aging finalization, requester identity and authority, cancellation guidance, bank-policy configuration, record history and stranded-run attention retain their previously recorded decisions or open status. |

No new open question duplicates a previously answered decision. The existing architecture-source finding continues to qualify the custom-field and Submissions standards. The existing missing no-inference charter sentence remains with the planning owner because the charter was outside the permitted write scope.

## Validation and Verdict

Dependency installation and corpus conformance completed successfully with zero errors. All four corpus tests passed. Conformance was also run before each artifact rewrite commit; these checks validate the corpus structure rather than prove the unresolved runtime races.

The corrected design is a faithful account of the examined implementation within its stated source limits, with observed departures kept separate from approved product direction. Its weakest areas are concurrent recovery and calendar sequencing, incomplete operational history, and external registration and orchestration evidence. Before implementation preparation, Andrew should resolve the aging and authority direction, the protected-batch planning disagreement, and the required recovery and attention behavior, while assigning the concurrency proof and missing external-source verification.