[bokelley]

First DX slice for #3504 (approved DX plan, section 6.1 stack strategy and section 3.1). It stacks on #3534 (and below it #3528, #3523, #3518, #3517, #3509, #3508, #3505), so it contains every earlier commit. Review only feat(reporting): move reporting-subscription building blocks to reporting/advanced. It targets main because CI runs only for PRs into main.

What changes

A new subpath, @adcp/sdk/reporting/advanced, is the only public home of the low-level reporting-subscription building blocks. The module, and every declaration it publishes, carries @experimental (policy added to docs/guides/REPORTING-STABILITY.md).

Group	Symbols	Previously exported from
Engine	createReportingSubscriptionEngineV1, reportingSubscriptionCoverageGrantedV1 and the engine types (ReportingSubscriptionEngineV1, ...HooksV1, ...AccountFactV1, ...FrozenOwedSetV1, ...)	reporting/service
Engine stores	createInMemoryReportingSubscriptionEngineStoreV1, createReportingSubscriptionEngineStateStoreV1, DEFAULT_REPORTING_SUBSCRIPTION_ENGINE_COLLECTION	reporting/service
Coverage function	expectedSubscriptionPeriods, groupExpectedSubscriptionPeriodsV1 and their input/row types	reporting/consumer, reporting/ledger
Calendar, selection	createReportingPeriodCalendarV1, parseReportingPeriodDurationV1, assertReportingIanaTimezoneV1, resolveReportingSubscriptionOfferingsV1, reportingSubscriptionScopeIncludesV1, ...	reporting/consumer, reporting/ledger
Capability builder	reportingConfigurationCapabilitiesV1	all three
Consumer bridge	reportingSubscriptionVersionRecordsV1, subscriptionExpectedReportingPeriodsV1	reporting/consumer
Service planner hooks	ReliableReportingSubscriptionsOptionsV1, ...BindingInputV1, ...GenerationContextV1, ...PolicyV1, withReportingSubscriptionCoverageV1	reporting/service

• reporting/service, reporting/consumer, reporting/ledger and the package root no longer reach any of them. The service's subscription option types and the coverage hook move to src/lib/reporting/service/subscriptions.ts, so the service declarations don't name them either.
• The names don't change. The renames are T4.
• What stays where it is:
  • the ledger store contract (reportingLedgerSubscriptionKeyV1, ReportingLedgerSubscriptionV1, reportingSubscriptionReceiptAdmissibleV1, ...), because custom stores and @adcp/reporting-storage implement it;
  • ReportingConfigurationImmutableError;
  • the buyer syncReportingSubscriptionsV1 (root), which the T7 facade wraps;
  • the @adcp/sdk/server principal exports.
• package.json declares ./reporting/advanced in exports and typesVersions like the other reporting subpaths.
• @adcp/reporting-storage imports withReportingSubscriptionCoverageV1 and ReliableReportingSubscriptionBindingInputV1 from the new subpath.
• The packed consumer check, the reference seller, the ledger guide and the tests import from the new subpath.
• test/lib/reporting-advanced-public-export.test.js checks the subpath declaration, the dist files, and that no other surface re-exports these symbols.
• File-count budget +8 (two dual-format module sets), with a comment. Byte budgets are unchanged.

Deviations from the plan

• The plan lists "the lifecycle option" (createPrincipalLifecycle({ reportingSubscriptions })) among the things that move. An option can't move to another subpath, so it stays until T4 collapses the option keys.
• @adcp/sdk/server keeps validateReportingSubscription, expandReportingSubscriptionPathTemplate and ReportingSubscriptionValidationError. The plan scopes this move to service, consumer, ledger and the root, and @adcp/reporting-storage uses expandReportingSubscriptionPathTemplate.

Stack CI

#3523's file-count failure is fixed on the stack. The stack now carries main's AdCP 3.3.0-beta.2 adoption (merged in from the conformance branch at 4ad844c). This branch also formats test/lib/reporting-subscription-coverage.test.js, which Prettier flagged after the beta.2 change in the lower stack.

Checks

npm run typecheck, lint:boundaries, check:package-size, the packed consumer and storage checks, Prettier, and every test/lib/reporting*, principal* and packages/reporting-storage/test suite (PostgreSQL suites skip locally; CI runs them).

Refs #3504

🤖 Generated with Claude Code

[aao-secretariat]

Ladon verdict: Approve

Approve — clean review, no blocking or medium findings.

The reviewer performed a genuine pass over the high-risk surface of this large reporting-subscriptions feature PR (82 files, ~28.6k additions):

• Ledger producer write path and caller-isolation across reads/status-ingest/receipts/notifications (fails closed, defense-in-depth).
• Managed-delivery authority re-checks before both deliver and settle (runtime.ts).
• Object-write path-traversal guards, calendar DST/timezone math, consumer-runtime principal.changed dedup/trailing-run coalescing, and server-side sync_principal validation.
• Largest file (engine.ts, 1753 lines) examined: coverage-grant filter + page budget, two-phase per-account CAS in reconcile, append-only freeze horizon that never recomputes.
• Witness-not-translator honored: producer refuses cross-account rows; offering_id emission gated on served version per DR-0033.
• Changesets correct (minor for experimental, @adcp/reporting-storage co-bumped); no hand-edited version line.

Decision table applied top-down: no critical/high findings (row 1 n/a); gated_paths is false (row 2 n/a); high_risk is false (rows 3/5 n/a); no medium findings (rows 4/8 n/a); no no-auto-approve team match (row 7 n/a); no prior decision (row 6 n/a). Falls through to row 9 → approve.

Note: review_decision is REVIEW_REQUIRED, but with gated_paths false that does not force escalate per the decision rules.

[aao-secretariat]

Ladon verdict: Approve

Approve — clean subsequent review.

This PR ships AdCP 3.3 reporting-subscription support (ledger, delivery, receipts, consumer runtime, storage adapters, docs, changesets). The delta since the prior approve is a single comment-only change to scripts/check-package-size.mjs documenting the packed tarball coverage size (26,370,041 bytes) against the unchanged MAX_PACKED_TARBALL_BYTES cap (26,420,000), leaving ~50 KB headroom. No behavioral change, no new code surface.

Checked:

• Changesets present for the src/lib/**, scripts/**, and package-affecting changes (nine .changeset/*.md files), satisfying changeset-vs-wire-impact.
• No hand-edited package.json version line.
• No high-risk paths flagged; no gated paths.
• No reviewer findings (critical/high/medium) in this run; prior run was also clean.

Decision table: no critical/high/medium findings → rows 1–8 do not fire (gated_paths false; high_risk false; no team gate). Falls through to row 9 → approve. Note: review_decision is REVIEW_REQUIRED but gated_paths is false, so row 2 does not apply.

[aao-secretariat]

Ladon verdict: Approve

Approve — clean subsequent review, no blocking or medium findings.

This is a follow-up pass on a prior approve decision. The reviewer made a clean pass over the incremental 6-file / 229-line delta and surfaced no Critical/High/Medium findings. Three source refinements were examined and all are correct and fail-closed with cited spec lineage plus matching new tests:

• calendar.ts refuses sub-daily billing_cycle per adcp#8622.
• engine.ts refreshes a changed pending_action on open exclusions and uses guarded latestPeriodEnd rather than trusting storage order.
• server/principal replace_account_configs now clears only on explicit false, fixing silent loss of a pending retry on an omitted flag.

Feature is covered by existing changesets (satisfies changeset-vs-wire-impact). No witness-not-translator concerns, no transport-client reimplementation, no doc-link drift.

Gate checks: no no-auto-approve team match; gated_paths is false; high_risk is false. Although review_decision is REVIEW_REQUIRED, row 2 only fires when gated_paths is true, which it is not here. No escalation triggers apply. With zero findings, the decision falls through to row 9.

The merge-base changed after approval.