[bokelley]

Summary

T1(b) of the reporting-subscriptions DX plan (#3504): the coverage function, engine, principal runtime, ledger and managed delivery conform to the AdCP 3.3.0-beta.3 rules. All 120 canonical coverage vectors pass, and the 9 expected failures from #3559 are removed.

This PR stacks on #3559 (bokelley/reporting-subscription-beta3, the signed beta.3 adoption), which stacks on #3557 and the rest of the #3504 stack. It targets main so CI runs, so the diff against main includes everything below it.

Review only eeeb370d (on top of 4e881b08).

Each beta.3 rule and where it landed

Rule	Where
#8617 cancellation_effective_at ends the flight	coverage.ts flightTimeline; managed toBuy reads it from get_media_buys
#8617 billing cutover stub [E, first boundary), stub: true	coverage.ts main walk via incomingHandoff; rows and groupOwedSubscriptionPeriodsV1; ledger ReportingSubscriptionLedgerObligationInputV1/ReportingLedgerObligationV1 stub; handler.ts wireObligation; service/index.ts plan mapping
#8618 flight_history replaces the non-wire prior_flights	coverage.ts (ReportingSubscriptionFlightHistoryEntryV1); managed toBuy
#8618 regranted_at as the wire source for re-grants	engine host fact (granted_at renamed to regranted_at); grant journal observeGrants returns {authorized_at, regranted_at?} and adopts a host value inside (revocation, now]; managed projectAccounts serves it on list_accounts/sync_accounts; managed roster passes it to facts
#8618 per-package offering snapshot	managed toBuy uses packages[].reporting_delivery_offering_ids from get_media_buys (falls back to all registered offerings when absent)
#8618 offering availability (available_from/withdrawn_at)	already read; now the generated wire type (ReportingSubscriptionOfferingV1 = ReportingDeliveryOffering)
#8619 sticky per-package resolution	selection.ts resolveReportingSubscriptionPackageV1, shared by coverage (packageResolutionAt) and the engine (resolvePackage)
#8619 admission ordered by authorized_at, then account_id, sticky	engine reconcile (principal document); exceptions keep their place; deactivation releases slots; exclude_account_ids are not candidates
#8619 several pacing/analytics feeds per purpose; lower subscription_id owes	principal assertNoSameLevelOverlap (billing only); engine overriddenPackages (package-level overridden with package_ids/overridden_by); coverage honours package-level exceptions
#8619 billing match: exact + dimensions	validateReportingSubscription (schema-enforced too)
#8619 destination_overrides	principal validation (destination exists, same pattern/transport, one entry per account/domain, templates); readback destination_override_refs (gated); reportingSubscriptionDestinationForAccount; binder input destination; @adcp/reporting-storage binder binds the override's destination_ref and template
#8619 in-place membership	principal fingerprint excludes membership; membershipEdits on the version; engine membershipOf, giving excluded_by_buyer from the edit's E, closing at the re-add's E, and a closed "joined" entry; removed accounts stay listed while open; coverage reads membership from excluded_by_buyer entries when published; buyer facade auto-versioning
#8619 paging	get_principal reporting_subscription_page (cursor, max_results ≤ 100, total_count); full lists kept and served 1,000 inline with totals; onReadbackOverflow deprecated (never called)
#8619 partial grants and SCOPE_INSUFFICIENT	assertReportingTaskGrantedV1; SDK service sync_reporting_status, storage service sync_reporting_receipts
#8619 account_id in primary_keys	service creation refuses a managed-delivery offering without it
#8620 money terms on matched/created, effective_at, not_carried_over	accounts.ensure AccountReady carries resolution, effective_at and not_carried_over (money terms on account); seller responses are validated by the beta.3 schema (fixtures in #3559)
#8622 day start	calendar.ts sub-daily local calendar: the first instant of each local date is a boundary
#8622 reactivation never owes twice	coverage.ts buildRegimes resumes + incomingHandoff
#8622 sub-daily billing_cycle	already refused

Non-wire inputs removed

• ReportingSubscriptionBuyV1.prior_flights and ReportingSubscriptionPriorFlightV1 are replaced by the wire flight_history.
• ReportingSubscriptionAccountFactV1.granted_at becomes the wire regranted_at.
• No deprecated acceptance is kept: neither the plan nor the vectors require it.

Canonical vectors

• Pinned at a6106149a2b5c929eec0caa0042adbae4ccf3a9c (tag v3.3.0-beta.3); vectors.json sha256 is 56cc381bc336b31cb0abc589d73d0f1a8ecd52f5c42532fc47fb9112c3b594a4.
• All 120 cases pass. The harness now also compares stub on rows and obligations.

Deviations and spec ambiguities

• Package added after confirmation. The wire carries no add time, so its resolution instant is taken as the buy's first resolution.
• Error vocabulary gap. error-codes.json has no code for the account_id primary-key rule, so the refusal uses the generic PLATFORM_CONFIG_INVALID until the spec adds one.
• SCOPE_INSUFFICIENT scope. It relies on the host's resolver returning the account with its authorization. A resolver that refuses the task itself still answers as unknown.
• Codegen gap. Generated destination_overrides items are empty objects (an anyOf/not/allOf codegen gap), so the principal module uses a local structural type. Follow-up: fix codegen.
• Python fixture divergence. grant-cases.json renames granted_at to regranted_at, and the Python copy needs the same rename.
• Engine buyRevisions. These internal snapshots are kept for package add/remove and for a host that changes a snapshot it shouldn't.

Checks

• typecheck, typecheck:reporting-storage, lint:boundaries, and Prettier on the changed files all pass.
• test:node:fast: 24,410 tests, 0 failures. test:node:slow and the @adcp/reporting-storage suite also pass (177 passed, 1 skipped). PostgreSQL cases run in CI.
• check:package-size: 26,838,560 bytes packed, 8,528 files, within the budgets set in feat: adopt signed AdCP 3.3.0-beta.3 and serve the reporting-subscription surface #3559. @adcp/reporting-storage packs to 447,061 bytes.
• Changeset: minor for both @adcp/sdk and @adcp/reporting-storage.
• New tests:
  • engine: in-place membership, two analytics feeds, admission order, paged readback
  • principal: membership, overrides, billing-only overlap
  • delivery: override routing, account_id primary key
  • grants: SCOPE_INSUFFICIENT
  • ledger: stub to wire
  • accounts: #8620 pass-through

🤖 Generated with Claude Code

[aao-secretariat]

Ladon verdict: Approve

Approve.

The reviewer verified commit eeeb370 (~1530 insertions across 39 files, diff reconstructed from git) and found no blocking or Medium findings that survived verification.

Checks performed:

• coverage.ts billing stub (L344-392) traced against the main walk — no double-count; adjacent-billing-regime cutover edge (L1099 cutoverEnd) resumes at ceil(H) adjacent to, not overlapping, the prior stub.
• engine.ts admission rewrite (L1143-1165) and overriddenPackages coherent; observeGrants regranted_at chain-continuation (L1858+) uses host value within (revocation, now].
• Changeset correctness: minor for both packages, correct policy for @experimental reporting surfaces even with documented breaking removals (prior_flights, granted_at→regranted_at). Witness-faithful; official transport clients untouched.
• 120 canonical vectors plus new unit tests cover the new branches.

Decision-table walk: no critical/high findings (row 1 n/a); gated_paths is false (row 2 n/a); high_risk is true but the only reason is bin/adcp.js (modified) with no medium finding on it (rows 3/5 n/a, no deletions); no medium data-loss/schema/infra findings (row 4 n/a); no prior decision (row 6 n/a); no no-auto-approve team match (row 7 n/a); zero medium findings (row 8 n/a). Falls through to row 9 — approve.

Note: review_decision is REVIEW_REQUIRED, but since gated_paths is false, no hard gate applies.

[aao-secretariat]

Re-approval: no reviewable delta since the prior approval; re-submitting after stale-review dismissal.

The merge-base changed after approval.