Design 62: the page is read-only and its reach internal before assignment (ADR 0481 v4)

03-DESIGN/01-to-be/62-the-bookkeeping-portal.md

@@ -55,8 +55,9 @@ machine then reaches the service without being copied between machines.
 
 ## 3. Who may see it
 
-The page requires `route` with an internal reach and `oidc-client` from Keycloak, as the mail web client does (ADR
-0440 §2, §3). A trusted setting `operators` names the identities let in by the ID token's user name; it is empty by
+The home server's route `reach` is set to `internal` before the page is assigned there, so the route proxy composes
+only the internal name, and the page answers 404 to any other host (ADR 0440 §2, ADR 0481 §6). It requires
+`oidc-client` from Keycloak, as the mail web client does (ADR 0440 §3). A trusted setting `operators` names the identities let in by the ID token's user name; it is empty by
 default, so nobody is let in until the operator names themself. Nothing about the page is public.
 
 ## 4. What it shows
@@ -69,14 +70,14 @@ default, so nobody is let in until the operator names themself. Nothing about th
 - **Documents and transactions.** Searchable lists for a period; a document opens as the file the service keeps,
   streamed through `bookkeeping.document`.
 
-The page reads live and keeps no copy (ADR 0481 §4). Keeping the history in a database of the mesh's own is the own
+The page only reads: it calls no verb that changes the service, and keeps no copy (ADR 0481 §4). Keeping the history in a database of the mesh's own is the own
 bookkeeping research (issue 1457), and a decision of its own.
 
 ## 5. What the accountant has done is never undone
 
-Every verb of `okioki` that changes the service reads the booking or document first and refuses one the accountant
-has reviewed, approved for sending or booked, naming it and why, and sends nothing (issue 1608, ADR 0481 §5). The
-page shows such items as locked. This holds for the agent's calls as much as for the page's.
+Every tool of `okioki` that changes the service, whoever calls it, reads the booking or document first and refuses
+one the accountant has reviewed, approved for sending or booked, naming it and why, and sends nothing (issue 1608,
+ADR 0481 §5). The page shows such items as locked.
 
 ## 6. In what order it is built
 
@@ -84,11 +85,12 @@ page shows such items as locked. This holds for the agent's calls as much as for
    from mail, the accountant guard (1608); assigned to the home server, its password given at its desk prompt, the
    laptop's retired on the operator's Approve.
 2. **The read-only page**: `okioki-web` with the overview, the to-do and the lists, behind Keycloak.
-3. **Changes from the page**: linking, tagging, marking paid and closing, each through the same guarded verbs.
+3. **Changes from the page** (linking, tagging, marking paid, closing) are not part of this design: they need a decision
+   of their own (ADR 0481 §4), and would go through the same guarded tools.
 
 ## 7. Still open
 
 - **The route proxy on the home server** did not answer its tools on 2026-10-21; whether it serves an internal name
   there is checked before step 2.
-- **Changes from the page** (step 3) wait for the guard's fields to be known: which of the service's fields an
-  accountant's submission sets is read from the service before 1608 is built.
+- **The guard's fields**: which of the service's fields an accountant's submission sets is read from the service
+  before 1608 is built.