# Version-bound backend/schema/contract inventory

Use this read-only workflow before a sprint extends an existing backend, schema, import pipeline, or write contract.

## Bind the evidence

1. Record full commit SHA, commit subject/time, and clean/dirty worktree state.
2. Read repository-local agent rules first.
3. Do not open productive databases, raw imports, reports, exports, or secrets.
4. Execute schema probes only against an in-memory or disposable synthetic database.

## Trace schema reality

Inspect initial schema, migration runner, compatibility migrations, version getter, and schema tests. Record each in-scope table's creation function, columns, FKs, unique/partial indexes, checks, triggers, and required-table coverage.

Do not equate `MAX(schema_version)=N` with a reproducible migration chain. Print the recorded migration rows. If compatibility builders rerun on every startup while only versions 1 and N are stored, require a real N+1 migration. Check whether the stored checksum covers executable SQL/code or merely a migration label.

## Trace domain surfaces

Map table → service symbols → API routes → focused tests for:

- accounts and every direct account writer;
- categories/tags and merge/archive semantics;
- productive transactions and corrections/reversals;
- import sessions/batches, candidates, line items, splits, and review projections;
- transfer pairing, confirm/reject, and budget-neutral semantics;
- plan/seed candidates and merchant/rule learning;
- audit events and HTTP write security.

Distinguish parallel account models and identify their canonical link. Search every direct writer, not only the obvious domain service.

## Review mutation boundaries

For every mutation classify:

- **Preview binding:** preview ID, payload hash, state revision, expiry, exact target IDs.
- **Explicit confirmation:** boolean/token versus merely naming the route `/confirm`.
- **Idempotency:** replay returns original entity, conflicts, or duplicates.
- **Atomicity:** nested helpers must not commit inside compound operations.
- **Concurrency:** guarded updates, checked row counts, competing-match unique indexes.
- **Audit:** one bounded/redacted event in the same transaction; DB-level immutability where needed.
- **Lineage:** immutable batch/item/source fingerprints versus mutable session metadata.
- **Mapping:** stable FK/versioned mapping versus source-account free text and name heuristics.
- **Security:** fail-closed writes, appropriate origin/CSRF/auth checks, typed/versioned request bodies.

A nested helper that calls `commit()` is a release-boundary hazard in transfers, splits, batch confirms, and review takeovers even when happy-path tests pass.

## Minimum verification

1. Apply migrations to an in-memory DB and report resulting version and in-scope table presence.
2. Print recorded migration rows to expose compressed history.
3. Run focused schema/contract tests when the existing environment supports them.
4. Recheck worktree status to prove the inventory made no repository changes.

If tests cannot run because the environment is not provisioned, report that separately without claiming success or persisting the transient setup failure as a rule.

## Reporting shape

Report in the requested language:

1. exact commit/schema binding;
2. reusable surfaces with exact files and symbols;
3. all account-creation/writer paths;
4. required boundary fixes ranked by severity;
5. Green/Yellow/Red reuse recommendation;
6. real verification evidence and unexecuted gates;
7. explicit statement that no out-of-scope data/files were accessed or changed.

Prefer exact files/symbols over generic prose, and always separate “exists” from “safe to reuse unchanged.”