# BAT-009 Planning

## Scope

- Implement REQ-011: manual asset create/update/deactivate write model, snapshot preview/close persistence, append-only correction policy.
- Implement REQ-012: mutation MCP tools/contracts, operator dashboard UX, source/is_closed_snapshot alignment.
- Preserve REQ-005/REQ-010 safe fallback when manual asset write paths are unused or new write metadata is absent.
- Use synthetic/temp data only for tests and verification evidence.

## Dependencies

- dcy-009 confirmed Discovery and approved REQ-011/REQ-012.
- Existing BAT-008 read model in `jarca_ledger_mcp/db.py`, `service.py`, `server.py`, `dashboard/app.py`.
- Existing dcy-007 response contract / `tests/test_contract_regression.py` expectations.
- Additive/idempotent SQLite migration discipline and dcy-002 backup/approval safety policy.

## Work plan

1. Create BAT-009 standard batch docs and register entry.
2. Extend schema/service write path for manual asset update/deactivate and snapshot preview/close/correction metadata.
3. Add mutation MCP endpoints/contracts for manual asset CRUD and snapshot preview/close.
4. Add dashboard operator flows for manual asset management and month-end close preview/execute.
5. Update baseline docs (`docs/data-model.md`, `docs/interface-contract.md`, `docs/project-structure.md`, `docs/runtime-flows.md`).
6. Run narrow validation first (targeted tests / contract regression / synthetic service probe / dashboard smoke).
7. If evidence satisfies ACs, move BAT-009 to release-candidate and REQ-011/REQ-012 to Implemented.

## Design Gate

- Result: standard batch 유지.
- Reason: schema, service, MCP contract, dashboard UX, correction policy, baseline docs를 함께 바꾸므로 design/verification depth가 필요하다.

## Risks and mitigations

- Correction semantics drifting from read model: mitigate by explicit correction metadata, latest-valid-close selection tests, and read-after-close probes.
- Mutation contract drift vs dcy-007: mitigate by extending contract regression snapshots/tests for new tools.
- Dashboard operator flow accidentally mutating without preview clarity: mitigate by separate preview/close actions and source/is_closed labeling.
- Hard delete breaking historical traceability: mitigate by soft delete default plus tests asserting deactivated items do not erase prior snapshots.