Reporting

The figures are assembled from the evidence already linked to the case, not from the request body. A filing whose amounts were retyped into a form is a filing whose amounts cannot be reconciled against the transactions they came from.

The draft is validated on generation and every field records the expression that produced it. A document that fails validation is stored as `validation_failed` rather than discarded, so the failure is inspectable.

Synchronous generation is fail-closed at 200 linked alerts and 200 distinct linked transactions. Overflow returns 409 before rendering or persistence. This installation has no complete filing path for an older case above that boundary; a partial regulatory report is never generated.

Lists bounded metadata and the SHA-256 digest of each immutable schema version; it never returns the XSD body. Authoritative schemas can be activated only from a signed content pack after maker-checker approval, and only when the exact self-contained XSD compiles under the recorded validator. This release supports XSD 1.0 and deliberately refuses XSD 1.1 and `xs:include`/`xs:import`; it never resolves network or host files.

A bounded, keyset-resumable filing register. Every item is a `ReportSummary` limited to reference, type, lifecycle/validation state, validator identity and generation time. It never returns case or party identifiers, validation error text, actor ids, external acknowledgements, source-event keys, free-text status reasons, document or schema digests, field traces, or rendered content. Those richer fields require `reporting.report_content.read` through the report-detail endpoint.

Returns customer-level filing content, content-derived validation detail and field provenance. Filing-register permission alone is insufficient.

This installation has no built-in NFIU/goAML transport endpoint or credentials. Local validation and approval never claim delivery. `record-submission` is the explicit manual boundary: after an authorised user exports and files the exact bytes through the authorised external channel, they record the externally obtained reference and actual filing time. The server binds that evidence to the authenticated actor and the immutable payload/schema digests. The database refuses `submitted`, `acknowledged` and `rejected` states without matching evidence.

The legacy `submit` action is intentionally absent from the supported enum and fails closed if an older client calls it. Placeholder schemas and stale XSD proof remain independently non-fileable (Q1).

Returns the bytes stored at generation time, not a document rebuilt from the current active template. `X-Content-SHA256` is the lowercase SHA-256 digest of the response. The payload contains customer-level filing content and requires the dedicated content permission; filing-register permission alone is insufficient.

A tenant-scoped, keyset-resumable operational queue for corrections, reversals, cancellations and chargebacks that affected automatic CTR reporting. Each row links the exact financial-event predecessor and the current statuses of any prior/resulting CTRs. `action_required` means an operator must follow the linked report or external amendment/withdrawal procedure; it does not claim assignment, resolution or regulator delivery. Batch-ingested and synchronous lifecycle events use the same ledger.

Reads the record by its exact partitioned financial-event identity. This is evidence of the reporting effect, not evidence that an external amendment or withdrawal was delivered.