v5.71.0 16 June 2026 Improvement

Credit-Note Journal Provenance Gate, Invoice Payment-Bound Tightening

Why This Matters

A credit note is how an issued invoice gets corrected. Before any money moves on a correction, the ledger needs the same provenance guarantee invoices already carry: every correction maps to exactly one posted journal, with no orphans and no duplicates. This release lands that guarantee as a deploy-time gate, ahead of the user-facing correction flow, so a credit note cannot reach production without its journal accounted for. Alongside it, the invoice payment-bound constraint sheds a branch left inert by the quote and invoice split, narrowing the rule to the single shape that can now occur.

The order is deliberate. The enforcement floor goes in before the feature, so corrections cannot drift the ledger once they are exposed.

Credit-Note Journal Provenance

Deploy-time bijection gate (AX-CN-001)

  • Every issued credit note maps to exactly one posted journal. The deploy pipeline now refuses to ship if an issued credit note has no journal, more than one journal, or a missing back-pointer to its journal. This mirrors the invoice issue bijection already in force, extending the same provenance discipline from invoices to their corrections.

    Proof anchor: deploy-time executable gate, AX-CN-001.

Invoice Payment-Bound Tightening

Single live branch (migration 111)

  • The payment-bound rule now covers only the shape that can occur. The quote and invoice split left an unreachable branch in the constraint that bounds payments against an invoice. That branch is removed, narrowing the rule to its single live form. No accepted value changes; the dead branch could not be reached.

    Proof anchor: database constraint, migration 111.

  • A dead index and a stale comment were removed. An index left from the same split, keyed on a column path no longer queried, was dropped. A column comment that described the pre-split behaviour was corrected. Neither change alters behaviour.

Executable Proof Anchors

The credit-note domain now carries executable invariant tests that run inside the deploy pipeline, alongside the gate above. Each pins a property the kernel must hold, so a regression fails the build rather than reaching production.

  • Journal provenance. A test asserts that issuing a credit note produces exactly one balanced journal, its revenue lines rated and its control lines not, with a single back-pointer to that journal. This is the unit-level companion to the deploy-time bijection gate.

    Proof anchor: executable invariant test, AX-CN-001.

  • Issue mapping. A test asserts that a credit note cannot be issued while any line is missing its account. The write is refused before it happens, on both the issue-on-create and the separate-issue paths.

    Proof anchor: executable invariant test.

  • Line floors. A test asserts that no negative net, VAT, gross, unit price, or quantity can enter a credit-note line. The floors have been enforced by database constraints since the credit-note schema landed; this anchor is the executable proof that they hold, and it is keyed to the property rather than to any one constraint, so it survives a change to which check fires first.

    Proof anchor: executable invariant test, AX-CN-002.

Operational Impact

  • A credit note cannot reach production without exactly one posted journal. The deploy fails otherwise, before any release carries the gap.
  • The credit-note journal, issue-mapping, and line-floor invariants are pinned by executable tests in the deploy pipeline; a regression fails the build.
  • The invoice payment-bound rule is narrower and matches the only invoice shape the kernel now produces.
  • No accepted invoice or payment value changes. The tightening removes unreachable branches only.
  • No public API surface changed. The credit-note correction endpoints are not yet exposed.

Versioning

The axiom registry advanced to 2.28. The change records the invoice payment-bound invariant in its single-branch form; no new axiom was minted in this release. The credit-note axioms close together when the correction cluster completes.

No public API surface changed.

Files Changed

Backend:

  • The deploy pipeline gained a credit-note journal provenance gate.
  • A database migration narrowed the invoice payment-bound constraint, dropped a dead index, and corrected a column comment.
  • The test suite gained executable proof anchors for credit-note journal provenance, issue mapping, and line floors.

Frontend / Docs site: None.

Known Issues

  • The credit-note correction flow (issuing a note, allocating it against an invoice) is not yet exposed over the API. This release lands the kernel-level provenance and constraint work that precedes it; the flow itself follows.

The next releases wire the correction flow, with the allocation-conservation invariant that stops a credit note from over-applying to an invoice or beyond its own total.