Phase 2 — owner confirmations of the lane specs' open lists

Status: the owner asked on 2026-09-29 to close the “for the owner to confirm” lists of the Phase 2 lane specs, by audit best practice. Every line is in the decision table (program workspace, p2d-confirm/decision-table.md): 52 confirmed as built, 26 already ruled (O-1..O-12 and the Phase 2c ledger), 13 needing an outside authority (listed in the ROADMAP), 1 owner choice, and the changes below. Base: phase-2c 3057f2cd.

Migration ranges

Lane	Range
D1 segregation of duties	00470–00479
D2 cash dates and approval amount	00480–00489
D3 tax configuration guards	00490–00499
D4 bank reconciliation lock	00500–00509

D1 — Segregation of duties (X1, X2)

• X2: an all_states (or any wildcard) grant never lets the preparer or claimant of a supplier payment, WHT remittance or SST payment approve it. The claimant rule applies to every grant shape.
• X1: the audited sole-owner exception (O-3a: exactly one active member, race-safe, mandatory reason, audit flag sole_owner_exception) extends to the approvals a one-member organization cannot otherwise make at all: supplier-payment approval, supplier bank-detail verification, employee payout-detail verification, WHT remittance approval, SST return payment approval, budget approval (answers the Phase 2c M-4 question) and payment-batch approval/mark paid. The exception never applies while a second active member exists. Same mechanism and flag as O-3a.

D2 — Cash dates and approval amount (X4, X8)

• X4: cash posts on the day it moved: a supplier payment on its payment_date, an AR receipt on its receipt_date, a batch’s payouts on the batch value date — with O-12’s rule (first open date on or after, reason recorded) when that date’s period is closed; a future date is refused. The O-6 batch auto-match window keys on the value date.
• X8: a supplier payment’s approval amount (the band an approver must cover) is the gross settled, not the net cash after withholding.

D3 — Tax configuration guards (X3, X5, X6, X7)

• X3: a purchase tax code cannot name the SST payable account (2140 / sst_payable), and a non-withholding code cannot name WHT payable (2160 / wht_payable).
• X5: an SST registration, WHT deductions and WHT remittances require base currency MYR.
• X6: a WHT remittance is due the day before the same date in the following month (the stricter reading of “within one month”), until a tax agent confirms otherwise; the register’s late flag follows it.
• X7: any reduced-rate withholding code (below the section’s standard rate) requires a treaty reference, as a 0% code does.

D4 — Reconciliation lock segregation (X9, BR-11)

• X9: a member who made a manual match or an opening clearance in a reconciliation cannot lock it; auto matches are exempt; a one-member organization uses the sole-owner exception.
• BR-11: a period or year close is refused until every active bank account with anything to reconcile is locked through the period end. The Owner may close anyway with a mandatory reason, audited with the list of accounts (accounting.period.close_unreconciled).

Every refusal is coded with an en/ms/zh sentence; every exception writes an audit row with a reason.

Outcome

What each lane shipped, and the implementation rulings an owner or auditor should know:

• D1 (segregation of duties): the audited sole-owner exception extends to supplier-payment approval, supplier and employee bank-detail verification, WHT remittance approval, SST payment approval, budget approval and payment-batch approval/mark paid, for a one-member organization only. An all_states grant no longer lets the preparer or claimant approve their own supplier payment, WHT remittance or SST payment. Implementation rulings: a sole owner’s void of their own money-out transition stays blocked (void is a reversal control, not an approval, and is out of this spec’s scope); a sole owner’s own claim or advance still cannot be settled in a batch they marked paid (payee ≠ marker is a claims rule, not covered here); a dynamic all_states grant on the preparer refuses rather than escalates for the three money-out kinds (M-6, parked — safe because it refuses more than it should, not less; revisit if a customer configures position grants for payouts).
• D2 (cash dates and approval amount): cash now posts on the day it moved — a supplier payment on its payment_date, an AR receipt on its receipt_date, a batch’s payouts on the batch value date — through O-12’s first-open-date rule; the O-6 batch auto-match window keys on the value date. A supplier payment’s approval amount is now the gross settled, not the net cash after withholding. Implementation rulings: the WHT register keeps the legal payment date for CP37 purposes while the ledger entry falls to the first open date when the payment date’s period is closed; the value date is not re-checked against a withholding code’s validity or FX rate at mark-paid time (N-1, parked).
• D3 (tax configuration guards): a purchase tax code can no longer name the SST payable account (2140/sst_payable), and a non-withholding code can no longer name WHT payable (2160/wht_payable). An SST registration and a WHT deduction or remittance are refused when base currency is not MYR. A WHT remittance is due the day before the same date next month (the stricter reading), until a tax agent confirms otherwise. Any reduced-rate withholding code (below its section’s standard pack rate) now requires a treaty reference. Implementation rulings: the X6 stricter due-date reading is unverified pending a tax agent (see the WHT spec); there is no SST input-tax credit ruling in Malaysia, so no code — purchase or dual-use — may name sst_payable; base currency is locked while an organization is in SST or WHT tax use, read under a FOR SHARE lock for concurrency.
• D4 (bank reconciliation lock): Finance (not only the Owner) can hold the reconciliation lock by default, to avoid a deadlock when the Owner performed the opening clearance; a member who made a manual match, journal-from-line or opening clearance in a reconciliation’s items cannot lock it, unless they are the sole active member. Deactivating a bank account is refused while anything is unreconciled after its latest live lock. A period or year close is gated on every active bank account being locked through the period end (BR-11), with the Owner’s audited override. A statement that does not end at month end delays the close for that account until one does. Cash dated inside a lock but posted after it was taken (D2’s back-dated payments and receipts) holds the close and deactivation until a later lock covers it.

Detail, including which files changed, is in each lane’s plan and review under .superpowers/sdd/p2d-confirm/.