MONEY: Rust Money plugin (model, maths, codec, API) + first screens (budget month, accounts, simple transactions) #462

test(money): independent range, card-queue and mixed-deficit properties (#462)

kayg referenced this issue from a commit

test(money): strict differential fuzz against the Python oracle (#462)

kayg referenced this issue from a commit

fix(money): never evict a Money handle that a request still holds (#462)

kayg referenced this issue from a commit

fix(money): replay every month before a write so derived totals stay exact (#462)

kayg referenced this issue from a commit

test(money): failing regressions for a cross-month move that counts a row twice (#462)

kayg referenced this issue from a commit

2026-09-30 01:59:41 +00:00

fix(money): journal cross-month moves so a row is never counted twice (#462)

kayg referenced this issue from a commit

test(money): expose stray spaces and ambiguous dots in typed amounts (#462)

kayg referenced this issue from a commit

2026-09-30 01:59:41 +00:00

fix(money): keep spaces meaningful and refuse ambiguous dots in typed amounts (#462)

kayg referenced this issue from a commit

2026-09-30 01:59:41 +00:00

fix(money): satisfy the checked index access in the group-width check (#462)

kayg commented

2026-09-30 02:03:56 +00:00

Author

Owner

Independent break-the-numbers review: final report (branch `job/money-numbers`)

Head: 0e5d74b3523323af16d716e56a325b12f03523d7. The branch merges job/money-plugin at ef67d5526, so this is a review of the current code (memo and tags split included). There are no pushes and no merges into dev.

Findings

#	Severity	Reproduction	Test	Fix
1	Blocking (data corruption)	A date change moves a row to another month in two writes. When the source removal fails and the undo fails too, or the process stops between the two writes, the row is in both month files and every balance counts it twice (checking 99800 instead of 99900).	`fdd4548c9`	`63ea86a36`: a move journal (`users/<id>/.calternal/money-move.json`, CreateNew) is written before the destination. Every request settles a leftover journal under the write lock: a row in both files is removed from the destination. An unsettled journal makes the next move a 409.
2	High	Each amount is in range, but the derived totals are not. `amount = 2^53-1` on top of a balance, a cleared subset, or a category sum was stored first, and after that every read of the budget failed.	`c1aa32d45`	`5f99d7d14`: `project_with` replays every month and builds the month and account responses before the write. The request gets a 400 and nothing is written.
3	High	Assigning to `2200-01` or `1900-01` wrote the row, and after that every replay exceeded the 1200-month bound, so the budget could not be read.	`343c1bd9f` (it fails when the replay is disabled)	`5f99d7d14`
4	High	With 64 cached Users, the per-User LRU evicted a handle that a request still held. The next request got a new handle with a new write mutex, so two Money writers could run at the same time.	`c1aa32d45`	`b1a44b1f3`: only idle handles are evicted.
5	High	Web: `1,2,3` was stored as 12300, and a sign inside parentheses flipped the sign.	`d015d18b2`	`1d63b0077`
6	High	Web: ar-EG and fa-IR formatted amounts did not read back (zero parsed as null).	`4aa6d9c6c`	`4044db742`
7	Medium	Web: all spaces were removed before parsing, so `1 2` became 12.00 in en-US, and `12 34` in fr-FR skipped the group-width check.	`1f51beee2`	`65fea3929`: a space inside the digits is accepted only as the group mark of a locale that groups with spaces.
8	Medium	Web: in de-DE with a 3-decimal currency (KWD, BHD), `1.234` was read as 1.234, but it is also the grouping of 1234.	`1f51beee2`	`65fea3929`: the input is refused, not guessed.
9	Low	A read that ran between the two writes of a move showed doubled balances until the next refresh.	`0e5d74b35`	`0e5d74b35`: the per-User lock is now an RwLock, and the four read handlers take it shared.
10	Low (gate)	`bun run check` failed on `1d63b0077` (`groups[0]` possibly undefined).	none	`c2a240384`

Not fixed (Low, UX; left for the Money owner):

The Outflow and Inflow fields take Math.abs, so a minus typed in Inflow is silently dropped.
The Add account form always stores a card opening balance as debt, so you cannot enter a card that is in credit.
Agent undo (#309) restores files one at a time. If an agent turn moved a row and only one file is restored, the row can be duplicated. This is outside Money's writes.

Checked with no defect found

Mixed cash/credit pool, rollover and the shared oldest-first queue. New properties cover a partial payment followed by refunds across months, and mixed deficits roll only their cash part whatever the file order.
Differential fuzz (tests/money/fuzz.{py,sh}, run by differential.sh). 500 seeded ledgers, 2000 month snapshots, with no divergence allowances. They cover cash and card spending, card refunds, opening card debt, several assignment rows, partial and excess payments, splits on cash and card, transfers to tracking, card cash advances and a year boundary. Every number matches the Python oracle exactly. Mutation check: if CardQueues::release releases only the first purchase, the fuzz fails at seed-0, while the 625 committed vectors still pass.
parse_minor. The ±(2^53−1) edges are exact at scales 0, 2 and 3 with 4096 padding zeros. Unicode digits, exponents, ++, +-, NBSP and ZWSP are refused.
Months without a file. continuous_months handles gap months, a year boundary and a mid-year start. Assignments in a gap month count.
Several assignment rows. The first row absorbs the difference, and its marker, tabs and case keep their bytes.
Card opening debt. The payment category funding that follows is correct.
Concurrent edits. A CAS race gives exactly one winner and a 409.
API sums match the core. A property checks balances, cleared balances and both transfer register legs against core replays.
No floating point. A guard covers both the core and the plugin sources. JSON amounts are i64 (a value such as 1.5 or 1e2 is a 400).

Gates (at `0e5d74b35`)

$ cargo fmt --check
exit=0
$ cargo clippy -p calternal-money --all-targets -- -D warnings
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 9.60s
$ cargo test -p calternal-money
test result: ok. 14 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s
test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.40s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.45s
$ cargo clippy -p calternal-plugin-money --all-targets -- -D warnings
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1.00s
$ cargo test -p calternal-plugin-money
test result: ok. 23 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.31s
$ tests/money/differential.sh
money vectors: 625 {'bills': 15, 'coverage': 19, 'due_date': 12, 'funding_state': 12, 'ledger': 152, 'minor': 41, 'parse': 296, 'rename_reference': 2, 'rollover': 12, 'set_property': 2, 'statements': 24, 'write_transaction': 38}
deliberate divergence (2 cases): amount beyond 2^53-1 minor units is rejected (JSON-exact range)
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.00s
Generated 500 random ledgers (2000 month snapshots)
strict random oracle ledgers: 500
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 1 filtered out; finished in 5.82s
$ bun run check   (apps/web)
COMPLETED 1949 FILES 0 ERRORS 0 WARNINGS 0 FILES_WITH_PROBLEMS
$ bun run test    (apps/web)
 Test Files  136 passed (136)
      Tests  850 passed (850)

The live adversarial probe (tests/adversarial/money_api.mjs, which gained a derived-range check) was not run on a real server in this review, because the server build is too heavy for the shared host now. Run it in the merge round.

Decisions (please confirm)

Move journal path: users/<id>/.calternal/money-move.json. Recovery rolls back: the destination copy is removed, because the move never reported success.
The web parser refuses ambiguous input (1.234 at 3 decimals in a .-group locale, and a stray space in a non-space-group locale). It does not guess.

Verdict

Yes: after these fixes, the numbers are correct enough to merge. The replay maths matches the oracle exactly on 625 vectors plus 500 strict random ledgers, and the invariants hold. The blocking data-corruption path (finding 1) and every High finding are fixed on this branch, each with a regression test. job/money-plugin must take this branch (merge job/money-numbers) before it merges into dev. The plugin at ef67d5526 without these commits is not fit to merge.

## Independent break-the-numbers review: final report (branch `job/money-numbers`) Head: `0e5d74b3523323af16d716e56a325b12f03523d7`. The branch merges `job/money-plugin` at `ef67d5526`, so this is a review of the current code (memo and tags split included). There are no pushes and no merges into dev. ### Findings | # | Severity | Reproduction | Test | Fix | |---|---|---|---|---| | 1 | **Blocking** (data corruption) | A date change moves a row to another month in two writes. When the source removal fails and the undo fails too, or the process stops between the two writes, the row is in both month files and every balance counts it twice (checking 99800 instead of 99900). | fdd4548c9 | 63ea86a36: a move journal (`users/<id>/.calternal/money-move.json`, CreateNew) is written before the destination. Every request settles a leftover journal under the write lock: a row in both files is removed from the destination. An unsettled journal makes the next move a 409. | | 2 | High | Each amount is in range, but the derived totals are not. `amount = 2^53-1` on top of a balance, a cleared subset, or a category sum was **stored first**, and after that every read of the budget failed. | c1aa32d45 | 5f99d7d14: `project_with` replays every month and builds the month and account responses before the write. The request gets a 400 and nothing is written. | | 3 | High | Assigning to `2200-01` or `1900-01` wrote the row, and after that every replay exceeded the 1200-month bound, so the budget could not be read. | 343c1bd9f (it fails when the replay is disabled) | 5f99d7d14 | | 4 | High | With 64 cached Users, the per-User LRU evicted a handle that a request still held. The next request got a new handle with a new write mutex, so two Money writers could run at the same time. | c1aa32d45 | b1a44b1f3: only idle handles are evicted. | | 5 | High | Web: `1,2,3` was stored as 12300, and a sign inside parentheses flipped the sign. | d015d18b2 | 1d63b0077 | | 6 | High | Web: ar-EG and fa-IR formatted amounts did not read back (zero parsed as null). | 4aa6d9c6c | 4044db742 | | 7 | Medium | Web: all spaces were removed before parsing, so `1 2` became 12.00 in en-US, and `12 34` in fr-FR skipped the group-width check. | 1f51beee2 | 65fea3929: a space inside the digits is accepted only as the group mark of a locale that groups with spaces. | | 8 | Medium | Web: in de-DE with a 3-decimal currency (KWD, BHD), `1.234` was read as 1.234, but it is also the grouping of 1234. | 1f51beee2 | 65fea3929: the input is refused, not guessed. | | 9 | Low | A read that ran between the two writes of a move showed doubled balances until the next refresh. | 0e5d74b35 | 0e5d74b35: the per-User lock is now an RwLock, and the four read handlers take it shared. | | 10 | Low (gate) | `bun run check` failed on 1d63b0077 (`groups[0]` possibly undefined). | none | c2a240384 | **Not fixed (Low, UX; left for the Money owner):** - The Outflow and Inflow fields take `Math.abs`, so a minus typed in Inflow is silently dropped. - The Add account form always stores a card opening balance as debt, so you cannot enter a card that is in credit. - Agent undo (#309) restores files one at a time. If an agent turn moved a row and only one file is restored, the row can be duplicated. This is outside Money's writes. ### Checked with no defect found - **Mixed cash/credit pool, rollover and the shared oldest-first queue.** New properties cover a partial payment followed by refunds across months, and mixed deficits roll only their cash part whatever the file order. - **Differential fuzz** (`tests/money/fuzz.{py,sh}`, run by `differential.sh`). 500 seeded ledgers, 2000 month snapshots, with no divergence allowances. They cover cash and card spending, card refunds, opening card debt, several assignment rows, partial and excess payments, splits on cash and card, transfers to tracking, card cash advances and a year boundary. Every number matches the Python oracle exactly. Mutation check: if `CardQueues::release` releases only the first purchase, the fuzz fails at seed-0, while the 625 committed vectors still pass. - **`parse_minor`.** The ±(2^53−1) edges are exact at scales 0, 2 and 3 with 4096 padding zeros. Unicode digits, exponents, `++`, `+-`, NBSP and ZWSP are refused. - **Months without a file.** `continuous_months` handles gap months, a year boundary and a mid-year start. Assignments in a gap month count. - **Several assignment rows.** The first row absorbs the difference, and its marker, tabs and case keep their bytes. - **Card opening debt.** The payment category funding that follows is correct. - **Concurrent edits.** A CAS race gives exactly one winner and a 409. - **API sums match the core.** A property checks balances, cleared balances and both transfer register legs against core replays. - **No floating point.** A guard covers both the core and the plugin sources. JSON amounts are `i64` (a value such as `1.5` or `1e2` is a 400). ### Gates (at 0e5d74b35) ``` $ cargo fmt --check exit=0 $ cargo clippy -p calternal-money --all-targets -- -D warnings Finished `dev` profile [unoptimized + debuginfo] target(s) in 9.60s $ cargo test -p calternal-money test result: ok. 14 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.40s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.45s $ cargo clippy -p calternal-plugin-money --all-targets -- -D warnings Finished `dev` profile [unoptimized + debuginfo] target(s) in 1.00s $ cargo test -p calternal-plugin-money test result: ok. 23 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.31s $ tests/money/differential.sh money vectors: 625 {'bills': 15, 'coverage': 19, 'due_date': 12, 'funding_state': 12, 'ledger': 152, 'minor': 41, 'parse': 296, 'rename_reference': 2, 'rollover': 12, 'set_property': 2, 'statements': 24, 'write_transaction': 38} deliberate divergence (2 cases): amount beyond 2^53-1 minor units is rejected (JSON-exact range) test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.00s Generated 500 random ledgers (2000 month snapshots) strict random oracle ledgers: 500 test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 1 filtered out; finished in 5.82s $ bun run check (apps/web) COMPLETED 1949 FILES 0 ERRORS 0 WARNINGS 0 FILES_WITH_PROBLEMS $ bun run test (apps/web) Test Files 136 passed (136) Tests 850 passed (850) ``` The live adversarial probe (`tests/adversarial/money_api.mjs`, which gained a derived-range check) was **not** run on a real server in this review, because the server build is too heavy for the shared host now. Run it in the merge round. ### Decisions (please confirm) - Move journal path: `users/<id>/.calternal/money-move.json`. Recovery rolls **back**: the destination copy is removed, because the move never reported success. - The web parser refuses ambiguous input (`1.234` at 3 decimals in a `.`-group locale, and a stray space in a non-space-group locale). It does not guess. ### Verdict **Yes: after these fixes, the numbers are correct enough to merge.** The replay maths matches the oracle exactly on 625 vectors plus 500 strict random ledgers, and the invariants hold. The blocking data-corruption path (finding 1) and every High finding are fixed on this branch, each with a regression test. `job/money-plugin` must take this branch (merge `job/money-numbers`) before it merges into dev. The plugin at `ef67d5526` **without** these commits is not fit to merge.

kayg referenced this issue from a commit

test(money): fuzz splits, tracking transfers and card cash advances (#462)

kayg referenced this issue from a commit

test(money): far-month assignments and a plugin float guard (#462)

kayg referenced this issue from a commit

fix(money): reads take the User's lock shared so a move is never half seen (#462)

kayg referenced this issue from a commit

2026-09-30 02:36:35 +00:00

Merge origin/dev into job/money-numbers (#462)

kayg commented

Author

Owner

Merge round: ready to fast-forward `dev`

Branch job/money-numbers, head 99288dcfe9433ffd07fb1b886a947fd66ef8201d (not pushed).
origin/dev 412ad2136 is an ancestor (checked with git merge-base --is-ancestor). The reviewed head 0e5d74b35 is also an ancestor.

Two merges:

17a8f75e9 merges origin/dev cefff9134 (133 commits). One conflict: tests/adversarial/authz_matrix.py DATA_PREFIXES. Resolution keeps both /api/v1/mail/ and /api/v1/money/. The mode tray, app-sidebar.svelte, run.sh, xuser_matrix.py, contracts/openapi.json and generated.ts auto-merged. The generated check regenerated both files with no diff.
99288dcfe merges origin/dev 412ad2136 (#467 Finder paste). It landed during the round. Web files only, no conflicts.

Migrations: the Money plugin adds no SQL migration. It stores its data as Markdown in the User's Home, so nothing can collide with dev.
Cross-User guard (#472): every Money {id} field is classified (budget_id, account_id, category_id, transaction_id, and the payment/transfer/card/from/to variants). The matrix replays all 11 Money identifier operations against a real A-owned budget, category, account and transaction.

No fixes were needed. Nothing produced a 5xx, a crash, accepted hostile input or a cross-User leak.

Gates (verbatim)

bun run build (apps/web): build=0

cargo fmt --check: fmt=0 (no output)

clippy (-p <crate> --all-targets -- -D warnings, CARGO_PROFILE_DEV_DEBUG=line-tables-only):

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 8.19s
clippy calternal-money exit=0
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 33.06s
clippy calternal-plugin-money exit=0
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1.09s
clippy calternal-plugin exit=0
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 3m 43s
clippy calternal-server exit=0

cargo test (per crate):

=== test calternal-money
test result: ok. 14 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.09s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.28s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test calternal-money exit=0
=== test calternal-plugin-money
test result: ok. 23 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.79s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test calternal-plugin-money exit=0
=== test calternal-plugin
test result: ok. 22 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test calternal-plugin exit=0
=== test calternal-server
test result: ok. 84 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 4.62s
test calternal-server exit=0

tests/money/differential.sh: differential_exit=0

100 passed in 4.98s
money vectors: 625 {'bills': 15, 'coverage': 19, 'due_date': 12, 'funding_state': 12, 'ledger': 152, 'minor': 41, 'parse': 296, 'rename_reference': 2, 'rollover': 12, 'set_property': 2, 'statements': 24, 'write_transaction': 38}
deliberate divergence (2 cases): amount beyond 2^53-1 minor units is rejected (JSON-exact range)
test rust_port_matches_every_recorded_oracle_vector ... ok
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.33s
Generated 500 random ledgers (2000 month snapshots)
strict random oracle ledgers: 500
test rust_matches_random_oracle_ledgers_without_divergences ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 1 filtered out; finished in 7.25s

bun run check (final head):

Text sizes use shared role tokens.
1790735579197 COMPLETED 1949 FILES 0 ERRORS 0 WARNINGS 0 FILES_WITH_PROBLEMS
check=0

bun run test (final head): web_test_exit=0

 Test Files  136 passed (136)
      Tests  869 passed (869)

bash packages/api-client/check-generated.sh (final head): generated=0 (no diff after regenerating)
python3 scripts/parity_matrix.py --check: Parity matrix: 187 web API actions, 113 shortcuts, 2 static commands, 131 menu actions, 30 settings groups, 168 actions with adapter gaps, parity=0
XUSER_CLASSIFY_ONLY=1 python3 tests/adversarial/xuser_matrix.py: Cross-User classification gate: 307 operations classified. test_xuser_classification.py: Ran 3 tests ... OK

Live probes (real local server from this tree)

bun tests/adversarial/money_api.mjs: money_api_exit=0

Money API probe: anonymous access, cursed IDs and months, hostile payees and amounts, malformed/oversized JSON, bad budget names and a 40-request write storm passed

XUSER_MATRIX_ONLY=1 tests/adversarial/run.sh: xuser_exit=0

Cross-User classification gate: 307 operations classified
Two-User OpenAPI matrix: 307 operations classified; 153 operations replayed; 549 A-ID vs missing-ID comparisons across B, C, D and anonymous; 15 identifier routes classified with no local fixture factory; median absolute timing delta 0.6 ms
Job/Mail/quota ownership checks: 77 comparisons; 0 denial failures

The 15 routes without a seeded object are the same non-Money routes as on dev (admin config and plugins, Unsplash, auth setup/invite/app-password, unified Mail inbox, note templates, journal fix-line, per-User plugin toggle). dev replayed 142 operations; this branch replays 153, and the difference is the 11 Money identifier operations.

bun e2e/money.mjs (apps/web, final head): money_e2e_exit=0, PASS captured 36 Money screenshots in .../artifacts/money. The mode tray shows Mail and Money side by side after the merge.

Rust gates, the differential test and the two server probes ran on 17a8f75e9. The #467 merge changes only web files, so those results still apply. The web gates, the generated-contract check, the parity check and the Money e2e ran again on 99288dcfe.

## Merge round: ready to fast-forward `dev` Branch `job/money-numbers`, head **`99288dcfe9433ffd07fb1b886a947fd66ef8201d`** (not pushed). `origin/dev` `412ad2136` is an ancestor (checked with `git merge-base --is-ancestor`). The reviewed head `0e5d74b35` is also an ancestor. Two merges: - `17a8f75e9` merges `origin/dev` `cefff9134` (133 commits). One conflict: `tests/adversarial/authz_matrix.py` `DATA_PREFIXES`. Resolution keeps both `/api/v1/mail/` and `/api/v1/money/`. The mode tray, `app-sidebar.svelte`, `run.sh`, `xuser_matrix.py`, `contracts/openapi.json` and `generated.ts` auto-merged. The generated check regenerated both files with no diff. - `99288dcfe` merges `origin/dev` `412ad2136` (#467 Finder paste). It landed during the round. Web files only, no conflicts. Migrations: the Money plugin adds no SQL migration. It stores its data as Markdown in the User's Home, so nothing can collide with dev. Cross-User guard (#472): every Money `{id}` field is classified (`budget_id`, `account_id`, `category_id`, `transaction_id`, and the payment/transfer/card/from/to variants). The matrix replays all 11 Money identifier operations against a real A-owned budget, category, account and transaction. No fixes were needed. Nothing produced a 5xx, a crash, accepted hostile input or a cross-User leak. ### Gates (verbatim) `bun run build` (apps/web): `build=0` `cargo fmt --check`: `fmt=0` (no output) clippy (`-p <crate> --all-targets -- -D warnings`, `CARGO_PROFILE_DEV_DEBUG=line-tables-only`): ``` Finished `dev` profile [unoptimized + debuginfo] target(s) in 8.19s clippy calternal-money exit=0 Finished `dev` profile [unoptimized + debuginfo] target(s) in 33.06s clippy calternal-plugin-money exit=0 Finished `dev` profile [unoptimized + debuginfo] target(s) in 1.09s clippy calternal-plugin exit=0 Finished `dev` profile [unoptimized + debuginfo] target(s) in 3m 43s clippy calternal-server exit=0 ``` cargo test (per crate): ``` === test calternal-money test result: ok. 14 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.09s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.28s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test calternal-money exit=0 === test calternal-plugin-money test result: ok. 23 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.79s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test calternal-plugin-money exit=0 === test calternal-plugin test result: ok. 22 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test calternal-plugin exit=0 === test calternal-server test result: ok. 84 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 4.62s test calternal-server exit=0 ``` `tests/money/differential.sh`: `differential_exit=0` ``` 100 passed in 4.98s money vectors: 625 {'bills': 15, 'coverage': 19, 'due_date': 12, 'funding_state': 12, 'ledger': 152, 'minor': 41, 'parse': 296, 'rename_reference': 2, 'rollover': 12, 'set_property': 2, 'statements': 24, 'write_transaction': 38} deliberate divergence (2 cases): amount beyond 2^53-1 minor units is rejected (JSON-exact range) test rust_port_matches_every_recorded_oracle_vector ... ok test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.33s Generated 500 random ledgers (2000 month snapshots) strict random oracle ledgers: 500 test rust_matches_random_oracle_ledgers_without_divergences ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 1 filtered out; finished in 7.25s ``` `bun run check` (final head): ``` Text sizes use shared role tokens. 1790735579197 COMPLETED 1949 FILES 0 ERRORS 0 WARNINGS 0 FILES_WITH_PROBLEMS check=0 ``` `bun run test` (final head): `web_test_exit=0` ``` Test Files 136 passed (136) Tests 869 passed (869) ``` `bash packages/api-client/check-generated.sh` (final head): `generated=0` (no diff after regenerating) `python3 scripts/parity_matrix.py --check`: `Parity matrix: 187 web API actions, 113 shortcuts, 2 static commands, 131 menu actions, 30 settings groups, 168 actions with adapter gaps`, `parity=0` `XUSER_CLASSIFY_ONLY=1 python3 tests/adversarial/xuser_matrix.py`: `Cross-User classification gate: 307 operations classified`. `test_xuser_classification.py`: `Ran 3 tests ... OK` ### Live probes (real local server from this tree) `bun tests/adversarial/money_api.mjs`: `money_api_exit=0` ``` Money API probe: anonymous access, cursed IDs and months, hostile payees and amounts, malformed/oversized JSON, bad budget names and a 40-request write storm passed ``` `XUSER_MATRIX_ONLY=1 tests/adversarial/run.sh`: `xuser_exit=0` ``` Cross-User classification gate: 307 operations classified Two-User OpenAPI matrix: 307 operations classified; 153 operations replayed; 549 A-ID vs missing-ID comparisons across B, C, D and anonymous; 15 identifier routes classified with no local fixture factory; median absolute timing delta 0.6 ms Job/Mail/quota ownership checks: 77 comparisons; 0 denial failures ``` The 15 routes without a seeded object are the same non-Money routes as on dev (admin config and plugins, Unsplash, auth setup/invite/app-password, unified Mail inbox, note templates, journal fix-line, per-User plugin toggle). dev replayed 142 operations; this branch replays 153, and the difference is the 11 Money identifier operations. `bun e2e/money.mjs` (apps/web, final head): `money_e2e_exit=0`, `PASS captured 36 Money screenshots in .../artifacts/money`. The mode tray shows Mail and Money side by side after the merge. Rust gates, the differential test and the two server probes ran on `17a8f75e9`. The #467 merge changes only web files, so those results still apply. The web gates, the generated-contract check, the parity check and the Money e2e ran again on `99288dcfe`.

kayg referenced this issue from a commit

2026-09-30 02:37:07 +00:00

Merge origin/dev (#467) into job/money-numbers (#462)

kayg commented

2026-09-30 02:37:14 +00:00

Author

Owner

First Money slice merged into dev (fast-forward to 99288dcfe) after the independent number review (#462 findings table) and the merge round (all gates and live probes green). Remaining for this issue: subscription FX matching, cancel-by/trial reminders, bills and statements in API/UI (statement Unrecorded waits on the owner), editing splits/transfers/card payments/FX rows, category/account rename/hide/delete, CLI/MCP/WebMCP adapters, deep-link e2e.

First Money slice merged into dev (fast-forward to 99288dcfe) after the independent number review (#462 findings table) and the merge round (all gates and live probes green). Remaining for this issue: subscription FX matching, cancel-by/trial reminders, bills and statements in API/UI (statement Unrecorded waits on the owner), editing splits/transfers/card payments/FX rows, category/account rename/hide/delete, CLI/MCP/WebMCP adapters, deep-link e2e.

kayg referenced this issue

2026-09-30 02:43:59 +00:00

Owner test tracker: every request and when it is testable on o2 #203

kayg referenced this issue

2026-09-30 04:46:09 +00:00

ONBOARDING: first-run flow design (modes, Connected Accounts, devices) + Money onboarding (grill) #475

kayg commented

2026-09-30 04:46:22 +00:00

Author

Owner

Owner decisions (2026-09-30 morning):

Money is off by default; the onboarding flow (#475) will decide it later. No starter categories ("vanilla"): a new budget has only the system markers.
The move journal and recovery, and refusing ambiguous amounts: agreed.
Running EMIs must be auto-recognised and suggested: offer to create the loan or EMI account and its payment plan from what the statements show.
Account kinds: the owner's proposal is debit (cash, checking, savings), credit (credit cards and any loan) and tracking (outside the budget). Being confirmed: whether loans belong in credit, or in their own kind (see the chat answer).
The statement "Unrecorded" question is pending: the owner asked how statements are used.
Low leftovers go in the next slice: a minus typed in Inflow is dropped; a card can't be opened in credit; agent undo restores files one at a time.

**Owner decisions (2026-09-30 morning):** - Money is **off by default**; the onboarding flow (#475) will decide it later. No starter categories ("vanilla"): a new budget has only the system markers. - The move journal and recovery, and refusing ambiguous amounts: agreed. - Running EMIs must be **auto-recognised and suggested**: offer to create the loan or EMI account and its payment plan from what the statements show. - Account kinds: the owner's proposal is **debit** (cash, checking, savings), **credit** (credit cards and any loan) and **tracking** (outside the budget). Being confirmed: whether loans belong in credit, or in their own kind (see the chat answer). - The statement "Unrecorded" question is pending: the owner asked how statements are used. - Low leftovers go in the next slice: a minus typed in Inflow is dropped; a card can't be opened in credit; agent undo restores files one at a time.

kayg referenced this issue

2026-09-30 05:06:51 +00:00

MONEY x MAIL: auto-capture card statements and transaction alerts from email; replace Shortcuts→Windmill→Actual pipeline (grill) #480

kayg commented

2026-09-30 05:06:54 +00:00

Author

Owner

Owner decision (2026-09-30): the account kinds are Debit (cash, checking, savings), Credit (cards and credit lines you spend from), Loan (EMIs and loans, paid down but never spent from; the balance sits outside Ready to Assign and the EMI is a monthly target on a payment category) and Tracking (off-budget: investments, assets). Loans are awkward in Actual Budget too, and calternal should solve them properly. Running EMIs are detected from statements and suggested as Loan accounts plus a payment plan. This replaces the spike's cash/card/tracking. It needs a format change in spikes/money-markdown and crates/calternal-money, with the kinds renamed and Loan added, and a number review for the Loan maths.

**Owner decision (2026-09-30):** the account kinds are **Debit** (cash, checking, savings), **Credit** (cards and credit lines you spend from), **Loan** (EMIs and loans, paid down but never spent from; the balance sits outside Ready to Assign and the EMI is a monthly target on a payment category) and **Tracking** (off-budget: investments, assets). Loans are awkward in Actual Budget too, and calternal should solve them properly. Running EMIs are detected from statements and suggested as Loan accounts plus a payment plan. This replaces the spike's cash/card/tracking. It needs a format change in `spikes/money-markdown` and `crates/calternal-money`, with the kinds renamed and Loan added, and a number review for the Loan maths.

kayg commented

2026-09-30 05:09:02 +00:00

Author

Owner

Started money-kinds on job/money-kinds, base 268b657451808355c1eecd32bf1c808ac079aa71. Read CLAUDE.md, CONTEXT.md, DESIGN §48 and all #462 owner comments. Scope: four account kinds, exact Loan payment maths, lossless legacy-kind migration, shared oracle vectors, API and Add Account form. No new dependency is planned.

Started money-kinds on `job/money-kinds`, base `268b657451808355c1eecd32bf1c808ac079aa71`. Read CLAUDE.md, CONTEXT.md, DESIGN §48 and all #462 owner comments. Scope: four account kinds, exact Loan payment maths, lossless legacy-kind migration, shared oracle vectors, API and Add Account form. No new dependency is planned.

kayg referenced this issue from a commit

2026-09-30 05:18:44 +00:00

docs(money): define Loan payment and EMI statement maths (#462)

kayg commented

2026-09-30 05:36:11 +00:00

Author

Owner

Loan maths and migration committed at ed346b19f after core clippy/tests passed. DESIGN §48 and research were committed first at 343f926d6. Merged origin/dev once (22a75ab56), no conflicts.

Evidence: a new property initially rejected debit; the readers now accept canonical kinds and old aliases. Loan-only interest does not change Category Activity or Ready to Assign. Full payments consume the linked Category once. Conversion and billed principal preserve Credit reserves. The monthly cash-priority pre-pass now includes Loan payment transfers, so Debit/Credit payments to one Category cannot change reserve funding when file order changes. Properties and recorded shared vectors cover both orders.

Decisions: principal/interest use a full payment transfer plus a separate Loan charge; no new split grammar. Overpayment may leave a positive Loan balance without funding the Budget. Raw serialization retains legacy bytes; account writes migrate only the kind values. The API/form will accept an optional positive monthly Loan target; no target posts transactions or assigns money. Loan totals will be distinct from on-budget and Tracking totals. Transfer/FX editing and EMI suggestion import remain later work already listed on #462.

Core gate output (verbatim):

    Blocking waiting for file lock on build directory
    Checking calternal-money v0.0.1 (/home/kayg/Developer/calternal-wt/money-kinds/crates/calternal-money)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 17.19s
test result: ok. 14 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.18s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.92s
test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.59s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.07s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s

Loan maths and migration committed at `ed346b19f` after core clippy/tests passed. DESIGN §48 and research were committed first at `343f926d6`. Merged `origin/dev` once (`22a75ab56`), no conflicts. Evidence: a new property initially rejected `debit`; the readers now accept canonical kinds and old aliases. Loan-only interest does not change Category Activity or Ready to Assign. Full payments consume the linked Category once. Conversion and billed principal preserve Credit reserves. The monthly cash-priority pre-pass now includes Loan payment transfers, so Debit/Credit payments to one Category cannot change reserve funding when file order changes. Properties and recorded shared vectors cover both orders. Decisions: principal/interest use a full payment transfer plus a separate Loan charge; no new split grammar. Overpayment may leave a positive Loan balance without funding the Budget. Raw serialization retains legacy bytes; account writes migrate only the kind values. The API/form will accept an optional positive monthly Loan target; no target posts transactions or assigns money. Loan totals will be distinct from on-budget and Tracking totals. Transfer/FX editing and EMI suggestion import remain later work already listed on #462. Core gate output (verbatim): ``` Blocking waiting for file lock on build directory Checking calternal-money v0.0.1 (/home/kayg/Developer/calternal-wt/money-kinds/crates/calternal-money) Finished `dev` profile [unoptimized + debuginfo] target(s) in 17.19s test result: ok. 14 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.18s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.92s test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.59s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.07s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s ```

kayg referenced this issue from a commit

2026-09-30 05:38:24 +00:00

feat(money): derive Loan payments and read canonical account kinds (#462)

kayg referenced this issue from a commit

2026-09-30 05:59:33 +00:00

feat(money): derive Loan payments and read canonical account kinds (#462)

kayg referenced this issue from a commit

2026-09-30 05:59:33 +00:00

feat(web): add four Money account kinds and Loan payment targets (#462)

kayg commented

2026-09-30 06:03:30 +00:00

Author

Owner

Gate environment finding: plugin clippy passed, but the plugin test compilation failed before running tests:

error: error writing dependencies to `/home/kayg/Developer/calternal-wt/notes-bridge/target/tmp/sccachev7uOQI/deps.d`: No such file or directory (os error 2)
error: could not compile `iana-time-zone` (lib) due to 1 previous error

This job exports its own target/tmp, but the shared sccache daemon used another worktree's removed temporary directory. The failed gate chain was stopped. The remaining Rust gates are being rerun with RUSTC_WRAPPER= for this job only; no shared daemon was stopped and no source/test expectation was changed.

The differential script passed 712 committed vectors plus 500 strict random ledgers (2000 month snapshots). Web check, 881 tests and the production build passed. Core commit is now 78fcd358c (the amendment includes the plugin's mechanical Cash/Card enum renames, so that slice builds independently); web slice is 361d7f453.

Gate environment finding: plugin clippy passed, but the plugin test compilation failed before running tests: ``` error: error writing dependencies to `/home/kayg/Developer/calternal-wt/notes-bridge/target/tmp/sccachev7uOQI/deps.d`: No such file or directory (os error 2) error: could not compile `iana-time-zone` (lib) due to 1 previous error ``` This job exports its own `target/tmp`, but the shared sccache daemon used another worktree's removed temporary directory. The failed gate chain was stopped. The remaining Rust gates are being rerun with `RUSTC_WRAPPER=` for this job only; no shared daemon was stopped and no source/test expectation was changed. The differential script passed 712 committed vectors plus 500 strict random ledgers (2000 month snapshots). Web check, 881 tests and the production build passed. Core commit is now `78fcd358c` (the amendment includes the plugin's mechanical Cash/Card enum renames, so that slice builds independently); web slice is `361d7f453`.

kayg commented

2026-09-30 06:10:27 +00:00

Author

Owner

The new account API regression test found a writer error: Loan creation with a monthly target returned 400, with expected one "target" property under ^loan-payment, instead of 201. codec::set_property replaces one existing property and does not insert a missing property.

Fix: extend the existing edit::add_category writer with an optional positive monthly target. Loan creation passes the target when it creates the payment Category. Existing Category and Credit creation pass None. The writer keeps existing line endings and unknown spans and does not add assignments. A new core regression checks the exact target, CRLF retention, no assignment rows and rejection of a zero target. Existing test expectations are unchanged. Core and plugin gates are being rerun after this change.

The new account API regression test found a writer error: Loan creation with a monthly target returned 400, with `expected one "target" property under ^loan-payment`, instead of 201. `codec::set_property` replaces one existing property and does not insert a missing property. Fix: extend the existing `edit::add_category` writer with an optional positive monthly target. Loan creation passes the target when it creates the payment Category. Existing Category and Credit creation pass `None`. The writer keeps existing line endings and unknown spans and does not add assignments. A new core regression checks the exact target, CRLF retention, no assignment rows and rejection of a zero target. Existing test expectations are unchanged. Core and plugin gates are being rerun after this change.

kayg referenced this issue from a commit

2026-09-30 06:20:07 +00:00

feat(money): create Loan payment categories and exact monthly targets (#462)

kayg referenced this issue from a commit

2026-09-30 06:33:36 +00:00

fix(money): use YNAB Loan target wording and cover plan validation (#462)

kayg commented

2026-09-30 06:42:20 +00:00

Author

Owner

Loan validation previously scanned accounts and Categories for each posting. I replaced those scans with borrowed ID maps and a set of Credit payment Categories. The final core clippy check passes with warnings denied. The full core test run is queued behind the cold production server build. No new dependency is needed.

The server clippy gate also passes. Shared sccache remains disabled only for this job because its daemon used another worktree's removed temporary directory; the shared daemon was not changed.

Loan validation previously scanned accounts and Categories for each posting. I replaced those scans with borrowed ID maps and a set of Credit payment Categories. The final core clippy check passes with warnings denied. The full core test run is queued behind the cold production server build. No new dependency is needed. The server clippy gate also passes. Shared sccache remains disabled only for this job because its daemon used another worktree's removed temporary directory; the shared daemon was not changed.

kayg referenced this issue from a commit

2026-09-30 06:53:52 +00:00

perf(money): index Loan posting validation to avoid ledger scans (#462)

kayg referenced this issue from a commit

2026-09-30 07:33:31 +00:00

test(money): cover Loans navigation at every review width (#462)

kayg referenced this issue from a commit

2026-09-30 07:33:31 +00:00

chore(api): regenerate the Money Loan contract from server schemas (#462)

kayg commented

2026-09-30 08:09:34 +00:00

Author

Owner

Production Money browser flow passed against the real local server and production web build. Loan creation keeps Ready to Assign unchanged and writes the monthly target. Bounded invalid-plan requests return 400 and leave the Money files byte-identical.

The review set has 72 screenshots: 390, 820 and 1440 px, light and dark, including all four kinds, Loans navigation, Loan register, Budget, other registers and quick entry. Fixtures are synthetic test data only. The screenshot readiness race is fixed in 67731f38310a8776182e6900f10cc9a60d256a4b; no product styling was changed. Original-resolution Loan screenshots were checked for clipping and icon placement. The desktop Loan icon/cap-height centers differ by 0.5 CSS px. Claude visual review remains required.

Server tests: 85 passed; 0 failed; 2 ignored. Current-source core tests pass. Final server clippy and the queued Plugin/generated-contract checks remain in progress.

Production Money browser flow passed against the real local server and production web build. Loan creation keeps Ready to Assign unchanged and writes the monthly target. Bounded invalid-plan requests return 400 and leave the Money files byte-identical. The review set has 72 screenshots: 390, 820 and 1440 px, light and dark, including all four kinds, Loans navigation, Loan register, Budget, other registers and quick entry. Fixtures are synthetic test data only. The screenshot readiness race is fixed in `67731f38310a8776182e6900f10cc9a60d256a4b`; no product styling was changed. Original-resolution Loan screenshots were checked for clipping and icon placement. The desktop Loan icon/cap-height centers differ by 0.5 CSS px. Claude visual review remains required. - [review.zip](https://git.kayg.org/attachments/e02016ff-eb15-4a65-963c-2d2d168aa5d5) - [money-add-loan-dark-1440.png](https://git.kayg.org/attachments/e440868a-6759-414f-bfc2-b67f01acf6af) - [money-add-loan-dark-390.png](https://git.kayg.org/attachments/88222a21-736d-4e58-bc2c-65b19f59a82b) - [money-add-loan-dark-820.png](https://git.kayg.org/attachments/2af6d8ff-af2a-4777-9f01-2340a4951ba5) - [money-add-loan-light-1440.png](https://git.kayg.org/attachments/451fca7f-a34f-4131-9296-a964de3449a6) - [money-add-loan-light-390.png](https://git.kayg.org/attachments/7ba0ba01-ca7f-4c48-bc6b-62212ce95a72) - [money-add-loan-light-820.png](https://git.kayg.org/attachments/c86aa377-db78-4a68-8976-c7610b9fbf9b) Server tests: `85 passed; 0 failed; 2 ignored`. Current-source core tests pass. Final server clippy and the queued Plugin/generated-contract checks remain in progress.

kayg referenced this issue from a commit

2026-09-30 08:13:22 +00:00

fix(test): wait for Money register before opening responsive navigation (#462)

kayg commented

2026-09-30 08:23:07 +00:00

Author

Owner

Built Debit, Credit, Loan and Tracking for Money. Branch: job/money-kinds. Head: 67731f38310a8776182e6900f10cc9a60d256a4b. Base: 268b657451808355c1eecd32bf1c808ac079aa71. Fetched and merged origin/dev once, in 22a75ab56. No push, deployment or merge into dev/main was performed.

Loan debt stays outside Ready to Assign. Debit payments consume the payment Category once. Credit payments move only funded money into Credit reserves. Explicit interest rows and card/Loan EMI transfers preserve the statement amounts. Prepayment uses the same payment rule. Loan creation can write a monthly target. Readers accept cash/card aliases; account writes emit debit/credit and keep all other source bytes. Tracking is unchanged. The implementation uses indexed account and Category lookups.

Files:

docs/DESIGN.md
docs/research/money-plugin.md
crates/calternal-money/src/budget.rs
crates/calternal-money/src/edit.rs
crates/calternal-money/src/ledger.rs
crates/calternal-money/src/schedule.rs
crates/calternal-money/tests/loans.rs
crates/calternal-money/tests/vectors.rs
crates/plugins/money/src/routes.rs
crates/plugins/money/src/views.rs
crates/plugins/money/src/tests.rs
spikes/money-format/budget_math.py
spikes/money-markdown/money_markdown.py
spikes/money-markdown/test_money_loans.py
tests/money/generate-vectors.sh
tests/money/record_vectors.py
contracts/vectors/money/money.v1.json
contracts/openapi.json
packages/api-client/src/generated.ts
apps/web/src/lib/components/money/AddAccountForm.svelte
apps/web/src/lib/components/money/MoneySidebar.svelte
apps/web/e2e/money.mjs

No dependency, lockfile or SQL migration change was needed. Loan property tests cover conservation, interest, Credit reserves, mixed-payment order and byte-stable migration. The reference has 712 vectors, plus 500 seeded random ledgers with 2000 month snapshots.

Gates (verbatim output excerpts; all required commands exited 0):

cargo fmt --check produced no output and exited 0.

cargo clippy -p calternal-money --all-targets -- -D warnings

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 13m 51s

cargo test -p calternal-money

test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.12s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.04s
test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.88s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.58s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo clippy -p calternal-plugin-money --all-targets -- -D warnings

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 11m 14s

cargo test -p calternal-plugin-money

test result: ok. 25 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 12.31s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo clippy -p calternal-server --all-targets -- -D warnings

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 68m 52s

cargo test -p calternal-server

test result: ok. 85 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 76.02s

tests/money/differential.sh

110 passed in 36.23s
money vectors: 712 {'bills': 15, 'coverage': 19, 'due_date': 12, 'funding_state': 12, 'ledger': 194, 'minor': 41, 'normalize_account_kinds': 1, 'parse': 340, 'rename_reference': 2, 'rollover': 12, 'set_property': 2, 'statements': 24, 'write_transaction': 38}
deliberate divergence (2 cases): amount beyond 2^53-1 minor units is rejected (JSON-exact range)
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.10s
Generated 500 random ledgers (2000 month snapshots)
strict random oracle ledgers: 500
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 1 filtered out; finished in 37.52s

bun run check (apps/web)

svelte-check found 0 errors and 0 warnings

bun run test (apps/web)

 Test Files  137 passed (137)
      Tests  881 passed (881)

bun run build (apps/web)

  Wrote site to "build"

bun e2e/money.mjs (production web build and real server)

PASS the User flow wrote exact Markdown and the screens show the derived numbers
PASS Loan creation and bounded request validation preserve Budget money and files
PASS captured 72 Money screenshots in /home/kayg/Developer/calternal-wt/money-kinds/artifacts/money

The API client also passed 9 tests. The built CLI regenerated OpenAPI and TypeScript with git diff --exit-code clean; all 308 operation IDs are unique. The official Cargo-based contract check was stopped when the revision stamp triggered a redundant full relink. The existing CLI contains the same API source.

Review evidence: 72 original screenshots at 390, 820 and 1440 px, in light and dark. Each kind, Loans navigation, Loan register, Budget, registers, quick entry and empty state are included. Fixtures are synthetic test data only. No screenshot was committed. Original-resolution Loan images were checked for clipping and icon placement. The desktop Loan icon/cap-height centers differ by 0.5 CSS px. Claude must perform the visual review.

Known gaps: general transfer, split and FX editing retain the existing API 422 boundary; statement rows and Loan maths can be read from Markdown. Automatic EMI import suggestions and interest estimates are not implemented. The two existing JSON exact-range differential allowances remain; no Loan allowance was added. Server tests retain two ignored tests. The real-server round covers bounded normal invalid-plan requests; the full hostile-input/storm probe was not run. Separate number review and Claude visual review remain before merge.

Decisions: the monthly payment at creation is optional; interest/principal use a full transfer plus an explicit debt-charge row; overpayment can leave a positive Loan balance outside Ready to Assign; raw parse/serialize remains byte-stable, with aliases normalized on account writes; Tracking accounts are never promoted automatically. These choices are recorded in DESIGN §48 and research §10, with YNAB and Actual citations.

Separate number review targets for #462:

Debit-to-Loan payments: verify Debit falls by the full payment, Loan rises by the same amount, and payment Category Activity/Available fall once. Verify exact minor-unit conservation, partial funding and next-month cash overspending.
Principal/interest: combine a full payment with explicit Loan interest/fee rows. Verify principal reduction is payment minus charges, with no second Category deduction or Ready to Assign movement. Reverse or edit a charge and replay all later months.
Credit-to-Loan payments: only the funded payment enters Credit reserves. Mix Debit and Credit payments in one Category, reverse file order and date ties, and check cash priority and rollover.
Card purchase converted to EMI: original purchase -> positive Credit/negative Loan conversion -> positive Loan/negative Credit billed principal -> Debit card payment. Check both written transfer directions, carried debt, partial bills, FIFO consumption and refunds. No Category money may be released by conversion or charged twice by billed principal.
Interest on a card EMI: compare interest accrued on Loan with interest billed on Credit. Use one statement charge once; test statement closing balance, cycle activity and account balances across month boundaries.
Prepayment/overpayment: zero debt, partial prepayment, full payoff, payment larger than debt, positive lender refund balance, zero amounts and range limits. Loan balances cannot enter Ready to Assign or transfer to Debit.
Loan links/plans: distinct payment Categories across Loans and Credit, missing/wrong links, targets with no postings, wrong currency or scale, credit cycle fields on Loan, and edits to earlier months.
FX and scales: zero/two/three/four-place currencies, exact fx total signs, transfers in transaction/budget currencies, interest vs principal rounding, split remainders and checked derived-sum overflow.
Migration: cash -> debit, card -> credit, tracking unchanged. Compare Python/Rust projection and canonical writer; raw parse/serialize stays byte-stable. Exercise mixed EOLs, BOM, opaque examples, unknown fields, names and amount text. No tracking EMI is silently promoted to Loan.
API/core parity: Loan total, on-budget total, Tracking total, cleared balances, both transfer register legs and monthly target creation. Invalid Loan requests must leave files unchanged; use the existing compare-and-swap and cross-User regression tests.

Cleanup: cargo clean removed 15545 files and 7.6 GiB. Web build output was deleted. Review artifacts remain in the worktree and on #462. The worktree is clean. Module and changed-function documentation was re-read before this report.

Built Debit, Credit, Loan and Tracking for Money. Branch: `job/money-kinds`. Head: `67731f38310a8776182e6900f10cc9a60d256a4b`. Base: `268b657451808355c1eecd32bf1c808ac079aa71`. Fetched and merged `origin/dev` once, in `22a75ab56`. No push, deployment or merge into dev/main was performed. Loan debt stays outside Ready to Assign. Debit payments consume the payment Category once. Credit payments move only funded money into Credit reserves. Explicit interest rows and card/Loan EMI transfers preserve the statement amounts. Prepayment uses the same payment rule. Loan creation can write a monthly target. Readers accept cash/card aliases; account writes emit debit/credit and keep all other source bytes. Tracking is unchanged. The implementation uses indexed account and Category lookups. Files: - `docs/DESIGN.md` - `docs/research/money-plugin.md` - `crates/calternal-money/src/budget.rs` - `crates/calternal-money/src/edit.rs` - `crates/calternal-money/src/ledger.rs` - `crates/calternal-money/src/schedule.rs` - `crates/calternal-money/tests/loans.rs` - `crates/calternal-money/tests/vectors.rs` - `crates/plugins/money/src/routes.rs` - `crates/plugins/money/src/views.rs` - `crates/plugins/money/src/tests.rs` - `spikes/money-format/budget_math.py` - `spikes/money-markdown/money_markdown.py` - `spikes/money-markdown/test_money_loans.py` - `tests/money/generate-vectors.sh` - `tests/money/record_vectors.py` - `contracts/vectors/money/money.v1.json` - `contracts/openapi.json` - `packages/api-client/src/generated.ts` - `apps/web/src/lib/components/money/AddAccountForm.svelte` - `apps/web/src/lib/components/money/MoneySidebar.svelte` - `apps/web/e2e/money.mjs` No dependency, lockfile or SQL migration change was needed. Loan property tests cover conservation, interest, Credit reserves, mixed-payment order and byte-stable migration. The reference has 712 vectors, plus 500 seeded random ledgers with 2000 month snapshots. Gates (verbatim output excerpts; all required commands exited 0): `cargo fmt --check` produced no output and exited 0. `cargo clippy -p calternal-money --all-targets -- -D warnings` ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 13m 51s ``` `cargo test -p calternal-money` ```text test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.12s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.04s test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.88s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.58s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cargo clippy -p calternal-plugin-money --all-targets -- -D warnings` ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 11m 14s ``` `cargo test -p calternal-plugin-money` ```text test result: ok. 25 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 12.31s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cargo clippy -p calternal-server --all-targets -- -D warnings` ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 68m 52s ``` `cargo test -p calternal-server` ```text test result: ok. 85 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 76.02s ``` `tests/money/differential.sh` ```text 110 passed in 36.23s money vectors: 712 {'bills': 15, 'coverage': 19, 'due_date': 12, 'funding_state': 12, 'ledger': 194, 'minor': 41, 'normalize_account_kinds': 1, 'parse': 340, 'rename_reference': 2, 'rollover': 12, 'set_property': 2, 'statements': 24, 'write_transaction': 38} deliberate divergence (2 cases): amount beyond 2^53-1 minor units is rejected (JSON-exact range) test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.10s Generated 500 random ledgers (2000 month snapshots) strict random oracle ledgers: 500 test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 1 filtered out; finished in 37.52s ``` `bun run check (apps/web)` ```text svelte-check found 0 errors and 0 warnings ``` `bun run test (apps/web)` ```text Test Files 137 passed (137) Tests 881 passed (881) ``` `bun run build (apps/web)` ```text Wrote site to "build" ``` `bun e2e/money.mjs (production web build and real server)` ```text PASS the User flow wrote exact Markdown and the screens show the derived numbers PASS Loan creation and bounded request validation preserve Budget money and files PASS captured 72 Money screenshots in /home/kayg/Developer/calternal-wt/money-kinds/artifacts/money ``` The API client also passed 9 tests. The built CLI regenerated OpenAPI and TypeScript with `git diff --exit-code` clean; all 308 operation IDs are unique. The official Cargo-based contract check was stopped when the revision stamp triggered a redundant full relink. The existing CLI contains the same API source. Review evidence: 72 original screenshots at 390, 820 and 1440 px, in light and dark. Each kind, Loans navigation, Loan register, Budget, registers, quick entry and empty state are included. Fixtures are synthetic test data only. No screenshot was committed. Original-resolution Loan images were checked for clipping and icon placement. The desktop Loan icon/cap-height centers differ by 0.5 CSS px. Claude must perform the visual review. - [review.zip](https://git.kayg.org/attachments/e02016ff-eb15-4a65-963c-2d2d168aa5d5) - [money-add-loan-dark-1440.png](https://git.kayg.org/attachments/e440868a-6759-414f-bfc2-b67f01acf6af) - [money-add-loan-dark-390.png](https://git.kayg.org/attachments/88222a21-736d-4e58-bc2c-65b19f59a82b) - [money-add-loan-dark-820.png](https://git.kayg.org/attachments/2af6d8ff-af2a-4777-9f01-2340a4951ba5) - [money-add-loan-light-1440.png](https://git.kayg.org/attachments/451fca7f-a34f-4131-9296-a964de3449a6) - [money-add-loan-light-390.png](https://git.kayg.org/attachments/7ba0ba01-ca7f-4c48-bc6b-62212ce95a72) - [money-add-loan-light-820.png](https://git.kayg.org/attachments/c86aa377-db78-4a68-8976-c7610b9fbf9b) Known gaps: general transfer, split and FX editing retain the existing API 422 boundary; statement rows and Loan maths can be read from Markdown. Automatic EMI import suggestions and interest estimates are not implemented. The two existing JSON exact-range differential allowances remain; no Loan allowance was added. Server tests retain two ignored tests. The real-server round covers bounded normal invalid-plan requests; the full hostile-input/storm probe was not run. Separate number review and Claude visual review remain before merge. Decisions: the monthly payment at creation is optional; interest/principal use a full transfer plus an explicit debt-charge row; overpayment can leave a positive Loan balance outside Ready to Assign; raw parse/serialize remains byte-stable, with aliases normalized on account writes; Tracking accounts are never promoted automatically. These choices are recorded in DESIGN §48 and research §10, with YNAB and Actual citations. Separate number review targets for #462: 1. Debit-to-Loan payments: verify Debit falls by the full payment, Loan rises by the same amount, and payment Category Activity/Available fall once. Verify exact minor-unit conservation, partial funding and next-month cash overspending. 2. Principal/interest: combine a full payment with explicit Loan interest/fee rows. Verify principal reduction is payment minus charges, with no second Category deduction or Ready to Assign movement. Reverse or edit a charge and replay all later months. 3. Credit-to-Loan payments: only the funded payment enters Credit reserves. Mix Debit and Credit payments in one Category, reverse file order and date ties, and check cash priority and rollover. 4. Card purchase converted to EMI: original purchase -> positive Credit/negative Loan conversion -> positive Loan/negative Credit billed principal -> Debit card payment. Check both written transfer directions, carried debt, partial bills, FIFO consumption and refunds. No Category money may be released by conversion or charged twice by billed principal. 5. Interest on a card EMI: compare interest accrued on Loan with interest billed on Credit. Use one statement charge once; test statement closing balance, cycle activity and account balances across month boundaries. 6. Prepayment/overpayment: zero debt, partial prepayment, full payoff, payment larger than debt, positive lender refund balance, zero amounts and range limits. Loan balances cannot enter Ready to Assign or transfer to Debit. 7. Loan links/plans: distinct payment Categories across Loans and Credit, missing/wrong links, targets with no postings, wrong currency or scale, credit cycle fields on Loan, and edits to earlier months. 8. FX and scales: zero/two/three/four-place currencies, exact fx total signs, transfers in transaction/budget currencies, interest vs principal rounding, split remainders and checked derived-sum overflow. 9. Migration: cash -> debit, card -> credit, tracking unchanged. Compare Python/Rust projection and canonical writer; raw parse/serialize stays byte-stable. Exercise mixed EOLs, BOM, opaque examples, unknown fields, names and amount text. No tracking EMI is silently promoted to Loan. 10. API/core parity: Loan total, on-budget total, Tracking total, cleared balances, both transfer register legs and monthly target creation. Invalid Loan requests must leave files unchanged; use the existing compare-and-swap and cross-User regression tests. Cleanup: `cargo clean` removed 15545 files and 7.6 GiB. Web build output was deleted. Review artifacts remain in the worktree and on #462. The worktree is clean. Module and changed-function documentation was re-read before this report.

kayg commented

2026-09-30 08:29:36 +00:00

Author

Owner

Independent Money account-kind and Loan number review started on job/money-kinds-review, base 67731f38310a8776182e6900f10cc9a60d256a4b. Read CLAUDE.md, CONTEXT.md, DESIGN §48, research §10 and the author report. Review uses synthetic fixtures only. Scope: exact replay, Loan/EMI differential coverage, public projections and existing write-integrity regressions. No UI change planned.

Independent Money account-kind and Loan number review started on `job/money-kinds-review`, base `67731f38310a8776182e6900f10cc9a60d256a4b`. Read CLAUDE.md, CONTEXT.md, DESIGN §48, research §10 and the author report. Review uses synthetic fixtures only. Scope: exact replay, Loan/EMI differential coverage, public projections and existing write-integrity regressions. No UI change planned.

kayg commented

2026-09-30 08:40:29 +00:00

Author

Owner

Independent account-kind review finding (test commit f93bb48f4):

Severity	Evidence	Status
Source preservation	Both Rust and Python alias migration remove trailing spaces/tabs and U+2003 after the kind token. `kind_migration_preserves_whitespace_around_the_value` fails against the author head; raw codec round trips are unchanged.	Token-only migration fix in progress.

Strict differential fuzz now generates Loan opening debt, Debit/Credit-to-Loan payments, explicit debt charges, both written Credit/Loan EMI directions and exact FX charges (JPY/KWD/CLF) across four months: 500 ledgers / 2000 snapshots passed without allowances. Independent properties for mixed-payment rollover, earlier-month charge edits and EMI FIFO/refunds also passed. All data is synthetic.

Independent account-kind review finding (test commit `f93bb48f4`): | Severity | Evidence | Status | |---|---|---| | Source preservation | Both Rust and Python alias migration remove trailing spaces/tabs and U+2003 after the kind token. `kind_migration_preserves_whitespace_around_the_value` fails against the author head; raw codec round trips are unchanged. | Token-only migration fix in progress. | Strict differential fuzz now generates Loan opening debt, Debit/Credit-to-Loan payments, explicit debt charges, both written Credit/Loan EMI directions and exact FX charges (JPY/KWD/CLF) across four months: 500 ledgers / 2000 snapshots passed without allowances. Independent properties for mixed-payment rollover, earlier-month charge edits and EMI FIFO/refunds also passed. All data is synthetic.

kayg referenced this issue from a commit

2026-09-30 08:44:32 +00:00

test(money): review Loan replay and expose alias whitespace loss (#462)

kayg referenced this issue from a commit

2026-09-30 08:44:32 +00:00

fix(money): preserve whitespace when migrating account kind aliases (#462)

kayg referenced this issue from a commit

test(money): pin Loan restrictions, FX totals and EMI statement cycles (#462)

kayg referenced this issue from a commit

test(money): retain case-insensitive kind keys during migration (#462)

kayg referenced this issue from a commit

fix(money): match kind property keys without changing their spelling (#462)

kayg referenced this issue from a commit