Group standard chart (locked core)

Requested 2026-10-08. Not in the original spec; added to docs/ROADMAP.md.

Decisions (owner, 2026-10-08)

1. Locked core = the top N levels of the standard. A subsidiary’s account at one of those local codes cannot be renamed, moved or deactivated (type is already immutable). Everything below is free.
2. Local accounts below the core are free. Consolidation already flags the unmapped ones.
3. Rollout = adopt + drift warning. The group owner sets N. A subsidiary admin runs Adopt, which creates the missing core accounts under its own prefix and locks the core. Running it again picks up later additions.
4. The standard is the owner’s own chart, its accounts of depth < N. No second copy to keep in step.

Shape

• company_group.standard_chart_levels (NULL = no standard; 1 to 6). Set by PUT /group/groups/{id}/standard-chart.
• group_chart_standards() is a SECURITY DEFINER read: the calling organization must be a member_org_id of a group_entity of the group; it returns the owner’s accounts of depth < N that are not entity-specific (control, system-role, module-owned or consolidation-tagged accounts are left out, as they come from the country pack). It is the only cross-tenant read, member reading owner, by group membership the owner registered.
• In the subsidiary: group_chart_adoption (one row per organization) and group_chart_locked(org_id, local_code). A BEFORE UPDATE trigger on account refuses a name, parent or active change on a locked local code (account_group_standard_locked).
• GET /accounting/group-standard answers the groups that offer a standard, the adoption, and the drift (standard accounts missing here, and accounts whose type or name differs). POST .../adopt {group_id} needs accounting.account.manage and an organization with an account code template.

Not built (say so, do not hide)

• The group owner’s list of drifting subsidiaries: it would need a second cross-tenant read (owner reading the member’s chart) and a consent decision. The drift shows on the subsidiary’s own screen.
• Un-adopting (releasing the lock) and auto-push to subsidiaries.
• A type mismatch cannot be repaired (type is immutable): it is reported and left unlocked.