The Rules That Never Bend — stock-domain invariants¶

What this covers. This is the quick-reference contract for the whole restaurant-inventory domain: the handful of rules that must hold at all times, no matter how a number was produced or which path produced it. Every other chapter in this bible teaches one area in depth; this one collects the load-bearing rules from all of them into one place you can scan. Each entry is a bold Rule, a one-line WHY, and — where a number makes it click — a small worked example. If a proposed change would break any rule below, the change is wrong, not the rule.

How to read this¶

These are invariants, not features — properties that are true on every code path, every day, regardless of who or what produced a value. They are deliberately terse. A newcomer should be able to read the bold lines and know what must never break; the WHY lines say why the system behaves as it does; the worked example is the proof.

A few rules are independence rules, written "X ⊥ Y" and read "X is independent of Y." They sound abstract, but each one closes a specific, expensive class of mistake — valuing an item by whether it happens to appear in a recipe; re-pricing stock just for moving between your own buildings; routing money off a label a customer can rename. The independence is the rule.

A note on words, used precisely throughout. A warehouse is the set of storage locations valued and closed together — a restaurant's back-of-house store, a bar store, a shared commissary; stock sits and is counted in the storage locations inside it (the walk-in, the back room, the prep room), and is valued by the warehouse around them. It admits one family of item and only one — either the things bought to be used up, or the durable units carried in the asset register — decided when it is opened and fixed for its life, so no set of books is ever half a cost pool and half a register. A restaurant is the business — the operation whose profit-and-loss the food cost lands on, with its own local clock and business date. They are deliberately different things; a single warehouse can serve several restaurants, and one restaurant can draw from several warehouses. "Kitchen" here only ever names a station on an item or a specific warehouse — never the business and never "the stock location" in the abstract.

1. On-hand is derived, never a stored number¶

Rule. How much of an item is on hand is derived from the boundary that governs the room on the requested day and the stock movements after it. For each room that boundary is the latest posted full or spot count that explicitly observed that item; else the settled closing balance; else the warehouse's initial balances from the beginning of its opening date. Earlier dates read the earlier movement history. A movement's quantity is unsigned; the sign is structural — the same quantity counts out of the movement's from-location and into its to-location. The total is computed when asked, never read from a mutable "quantity on hand" figure.

WHY. One ordered boundary plus later events prevents double counting and drift. It also lets a published observation inform daily operations without pretending that an observation has already become settled history.

This is the perpetual-inventory spine — perpetual inventory means on-hand is kept continuously live off a journal of movements rather than counted up once a month. Value follows the same rule with one difference of timing: an item's worth is its weighted-average cost (defined in rule 8) — provisional inside the open period, struck once at the close — also derived, never a stored "stock value" column. The "as of a date" read is a boundary plus a bounded tail. A close contributes settled fact; a posted count contributes a provisional quantity, while the warehouse's initial balances supply its starting quantities and value. In every case the answer is a derivation, never a mutable total treated as truth.

Worked example. The warehouse begins the 10th with 18 kg of flour at one storage location. A 2 kg issue on the 10th leaves 16 kg that day. A full count on the 11th finds 15 kg and is posted, so the operational quantity becomes 15 kg; its 1 kg discrepancy remains for reconciliation. No mutable total supplies either answer.

2. The close is the line between correcting and carrying forward¶

Rule. A mistake is put right by putting the document right, and the movements it made follow. While its period is closed, the document and movements stay settled, and news that arrives later is a new dated fact in the open period. A controlled period reopening withdraws the governing close while retaining its original result and evidence (Period close §8); it is also how a goods receipt dated in a closed period is corrected (Stock ledger §6).

The document layer comes in two species, told apart by whether anything on the paper has to be settled before the books can be asked.

Paperwork with something to settle — a goods receipt whose lines await review and whose rows may not yet name a place, a production run whose arithmetic has to balance, whose losses have to be accepted and whose floor has to be named — opens as a draft: freely editable, moving no stock, until the person signs it off. Posting then asserts the document as a whole and emits its movements; a posted document keeps answering for them while its facts remain settled. Corrections follow the document's own settlement rules, and cancelling withdraws its movements. A stock count instead publishes an observation when posted; only the close creates its accepted correction movements (rule 3). Why a draft: the person who writes such a sheet is often not the person who signs it off, and a half-settled document must be able to sit overnight without touching the books.

Paperwork with nothing to settle — a sale, a waste write-off, an internal consumption, a transfer between the company's own warehouses — is a fact: saving it is asserting it, and the movements are emitted in the same breath. A sale is the extreme case, because nobody is composing it at all: each line posts the moment it can, and a line that cannot post yet is held. Whether a document opens as a draft decides how it enters the books, never what may be put right: once it exists it is corrected like any posted document — a line answered wrongly is answered again, and a document filed under the wrong day, warehouse or restaurant is moved, its movements withdrawn where they stood and recorded where the fact now belongs.

WHY. Two things must be true at once: an operator has to be able to fix yesterday's mis-keyed delivery without learning a correction ritual, and a period somebody has already published must not silently change. Putting the boundary at the close buys both. Before it nothing has been struck — no price, no snapshot, no figure anyone reported — so the book can simply be made to say what happened. After it, the period's price is struck, its snapshot is the next period's opening balance, and another warehouse may already have priced a transfer this one sent; reaching back would silently restate all of it.

Value obeys the same discipline as quantity. A price keyed wrong on a receipt is corrected on the receipt, as its quantity would be. A sending warehouse's price struck after the receiver has closed is news, not a correction: it is recorded as an explicit, dated valuation entry in the receiver's open period (rule 8, and Costing & valuation).

Worked example. A goods receipt posts 25 kg of flour at €0.80/kg, then the operator notices it was really 24 kg. While the month is open the receipt is edited to 24 kg and the book reads 24 — the number that was always true. Discovered after the month closed, the same edit is made inside the reopened month.

3. The count wins — as an observation, then a gesture¶

Rule. When the book and a physical count disagree, the count is the truth. A stock count is a snapshot of absolute quantity, not a change: it records the observation ("the walk-in holds 18.0 kg") and moves nothing. The book is brought to agreement by a separate human gesture — accepting each surviving gap — and by the close that consumes those acceptances, emitting the overage and shortage movements for exactly what was accepted, dated the period's last day. Those adjustments are valued at the period's own price, like everything else that moved — the book yields to the count, never the other way round.

WHY. The running book is only a claim assembled from the movements someone remembered to record; the count is the one event that sees what the book cannot — theft, spoilage, over-portioning, a misread delivery — so when the two disagree, reality (the count) is authoritative. And counting and adjudicating are different jobs done by different people at different times, so the observation and the correction are separate acts.

A shortage priced like any other issue is exactly how shrinkage lands in cost of goods sold. The close stands on chosen evidence: one complete full count per storage location requiring one, named by whoever answers for the close — no window, no candidacy rule. A closing count keeps its own honest date and asserts at the day the period ends, while the corrections carry the period's; it is never rolled back through the movements after it. The running book is the provisional layer beside that: each room uses the latest posted observation of each item — quantity re-based by an explicit full or spot observation, price by none — without a movement or settlement, and the close reads the seated forms, which the accountant alone swaps (rules 25, 26). An operator who wants the settled book trued mid-period closes early. A storage location with no starting stock, period activity, observed stock or assets needs no empty count. Starting value comes from the warehouse's initial balances, and new external value from a priced goods receipt. A count establishes quantity, never cost: an overage on a live pool adds quantity and no value — the found units join the period price's denominator — and value is never born without a priced document; the why is Costing & valuation's. Small tools are the strict case of the same rule: a count may record more pans than the book claims — the sighting is never refused — but the surplus cannot be reconciled into stock: converting it is declined, and a period will not close over it, because a pan leaves the books one unit at a time as a write-off, and a surplus of durables is a receipt nobody entered — the one honest source of a unit's cost. The found units wait for the receipt that bought them, which lifts the quantity and prices it in one gesture.

Worked example. The book says 18.5 kg flour on hand; the count records 18.0 kg and moves nothing. The accountant checks the journals and accepts the gap, and at the close a 0.5 kg shortage posts (a movement from the counted storage location to stock loss), valued at the period's price like a sale of 0.5 kg would be; what remains is worth 18.0 kg at that same price. The unexplained shrinkage flows into cost of goods sold automatically — nobody had to hand-write a single "write-down."

4. The base unit is frozen the moment an item has history¶

Rule. Every item has one base unit — the single dimension it is measured and costed in (pieces, or grams, or milliliters). It is chosen once and locked the instant any stock movement references the item; after the first posting it can never change.

WHY. The base unit is the denominator of every stored quantity and every unit cost for that item; changing it would silently re-interpret every historical number already in the journal.

Nothing enters the journal except after being converted to the base unit at the moment of posting, so all the downstream math — totals, costs, variance — works in plain base-unit decimals and never has to think about units again. If grams quietly became milliliters after a thousand movements had been stored "in grams," all thousand numbers — and every cost derived from them — would now mean something different, with no way to fix it, because the system deliberately does not convert between mass and volume (it would need a density it does not model). So the anchor is frozen the moment it acquires history.

5. Value is per warehouse; profit-and-loss is per restaurant¶

Rule. An item's value — its weighted-average cost, one shared cost pool — is computed per company, per warehouse, per item: you value stock where it physically sits. Cost of goods sold, by contrast, is attributed per restaurant (a profit center — the business unit a margin belongs to): it is derived and stamped onto the consumption movements, and a restaurant never owns a stock pool of its own.

WHY. "What is a kilogram of flour worth right now?" and "which restaurant earned the margin on that pasta?" are different questions with different correct answers at different grains — value follows the building that holds (and paid for) the stock; margin follows the restaurant that sold it.

A profit center is the unit you measure profitability against — here, the restaurant. Each restaurant selects one current consumption warehouse, and several restaurants may share it. Commissary goods reach that warehouse by explicit transfer before consumption. A per-restaurant profit-and-loss is a roll-up of the consumption attributed to it, never a second place value is measured; "company-wide" valuation is only the special case of a single warehouse.

Worked example. A shared commissary preps a batch of base sauce and holds it at €0.85/kg — one place, one pool, one weighted-average. Restaurants A and B are each supplied by transfer: the sauce moves into each restaurant's own warehouse, carrying the commissary's €0.85 cost with it (value follows the goods, warehouse to warehouse). When either restaurant sells a dish, the consumption depletes its own warehouse — never reaching back into the commissary's — and the cost-of-goods euro is stamped to A's or B's profit-and-loss respectively (margin follows the restaurant). One commissary's cost, two profit-and-loss statements, no double-counting — and every warehouse's count stays truthful at both ends, because stock is only ever consumed where it actually sits.

6. Behavior routes off stable policy fields, never a category name¶

Rule. Every accounting and movement decision branches on stable, enumerated policy fields on the item — how it is treated for accounting, what its recipe role is — and the facts derived from those. It never branches on the item's category, which is a name and an id a customer controls.

WHY. A category is a user-extensible, localized label — the same category reads "Packaging" in English and "Упаковка" in Russian, and a customer can add their own — so any behavior keyed on a category name or id is keyed on data the customer can edit; renaming or re-localizing it would silently re-route money.

The accounting treatment is one of six: stock (perpetual inventory — on the stock journal, counted, valued: flour, chicken); small tools (pans, knives — pooled at cost and expensed the day each one dies); consumable (expensed on receipt, never carried as on-hand — salt, cleaning sprays); counted consumable (expensed on receipt, with a quantity book worth zero kept beside the settled money — gloves, printed menus); fixed asset (capitalized and depreciated — an oven, a delivery van, handled in fixed-asset accounting); or phantom (never materializes, being neither held nor bought, so there is nothing of its own to account for — a made-to-order carbonara, an hour of a meeting room, whose sale, internal use and write-off alike spend the materials its recipe explodes into). That treatment is resolved once, persisted on the item, and fixed while a close still in force has settled history under it — open-period history re-derives instead, so behavior always keys off a stable choice, never a label on a dropdown. (The treatment also routes what a goods-receipt line does — into stock, into the small-tools pool, straight to expense, or into the asset register — and it is the same treatment, not a "procurable" gate of its own, that refuses a phantom on an order or a receipt: nothing of one ever arrives.)

Worked example. A salt sachet is expensed on receipt with the ingredient recipe role; a takeaway clamshell is a stock item with the packaging role. A customer renames the category "Consumables" to "Disposables" and adds a "Compostables" category of their own. Because behavior reads the items' policy facts and not the category, not one accounting decision moves — the salt is still expensed, the clamshell still counted and rolling into packaging cost, no matter what the labels say.

7. Valuation ⊥ recipe role¶

Rule. How an item's money flows (its accounting treatment) and what it may be inside a recipe (its recipe role) are independent axes. A consumable (oil, salt) is not carried on-hand, counted, or valued — yet, carrying the ingredient role, it is a first-class recipe ingredient, costed in recipes at a reference price (its last purchase, or a standard) and left out of counts and actual-usage variance, where it counts toward theoretical usage only.

WHY. Gating recipe-membership on "is it stocked?" would either force every recipe ingredient to be perpetually counted (absurd for a pinch of salt) or bar cheap staples from recipes entirely — both wrong, because the two concerns are simply different questions.

Independent does not mean ungated. Recipe-membership is gated by the role: an ingredient line may point only at an ingredient (an atom that never decomposes) or a producible item (a made thing with its own recipe); a packaging row only at a packaging item. Small tools and fixed assets carry no role and can never be picked onto a recipe — which is what turns "gloves never reach cost of goods" into a structural guarantee rather than a convention. Food attributes stay ungated: any item can carry nutrition or allergens, including resale goods like a bottle of cola.

Worked example. A vinaigrette recipe uses 200 g romaine (stock, role ingredient: counted, valued at weighted-average cost, contributes to actual-usage variance) and 15 g salt (expensed on receipt, role ingredient: never counted, costed at its last-purchase reference price, contributes only to theoretical cost). Both are ordinary recipe ingredients; the role is what lets each sit on the recipe, and the treatment decides how each is costed and reconciled.

8. Quantity ⊥ value¶

Rule. A movement can change quantity without changing total value, and the costing layer changes independently of where units physically sit. Moving stock between two storage locations of one warehouse touches value not at all — they share the pool — and moving it between two of your own warehouses leaves the company's total untouched; the arriving value simply joins the receiving warehouse's pool and takes its place in that pool's period price.

WHY. Quantity and value are two different facts about the same stock — carrying a kilogram from one of your buildings to another does not create or destroy a euro of inventory value — so the value layer must be decoupled from the quantity layer, or every internal transfer would fabricate or vaporize money.

Weighted-average cost (WAC) means every unit of an item in a warehouse shares one blended price, struck over everything that came into the pool. Conceptually there are distinct layers — the event (a movement happened), the on-hand (derived quantity), and the value — and they stay distinct even where they share one journal.

Worked example. Transfer 10 kg flour from the commissary (€0.85/kg) to the bar store. Quantity moves: −10 kg at the commissary, +10 kg at the bar store. Total value across the company is unchanged. The bar store's pool takes in 10 kg at €0.85, and that value joins the arrivals its period price is struck from; no value was created by the act of moving it. A difference in cost between two warehouses is a blend at the destination, not a gain or a loss.

9. Stock is valued net of recoverable tax¶

Rule. The value that feeds an item's weighted-average cost is net of any input tax the business gets back. Every goods receipt carries two money figures: the gross total (what you owe the supplier) and the net capitalized amount (what actually feeds the journal and the cost). The cost reads the net figure, never the gross.

WHY. Recoverable tax is money the business reclaims from the tax authority, not a cost of the goods — capitalizing it into inventory overstates cost of goods sold, and food-cost percentage, by the tax rate.

The value the receipt movement carries into stock is the landed cost of each line: the goods, plus freight and handling allocated across the lines, plus that line's non-recoverable tax. Two tax regimes, one path: where input tax is recoverable (the EU, Portugal first), it becomes a receivable and inventory is valued net of it; where it is not (the US, where purchases for resale are exempt), the recoverable portion is zero and net simply equals cost.

Worked example (EU, 23% recoverable VAT). Receive flour: subtotal €100, tax €23, bill total €123. The gross figure is 123 (what you owe the supplier). The net figure is 100 (the €23 is reclaimed from the tax authority). The weighted-average cost blends in €100, not €123 — or every dish made from this flour would carry a 23% phantom cost. Same flour, US, exempt for resale: the recoverable portion is 0, so net = gross = 100 — identical math, no special case.

10. A sale explodes the recipe as it was on the sale's own date¶

Rule. Costing a sale unpacks the recipe as it stood on the sale's business date — the textbook name is exploding a bill of materials (a bill of materials is the full ingredient breakdown of a made item). The system resolves the recipe version in force on that date, resolves the concrete build the sale declares or the base build when it declares none, walks that build down to raw ingredients, and pins that version's identity onto every consumption movement so the costing can always be reproduced.

WHY. Costing has to be reproducible and honest at once. Honesty in the open period means the books follow the standard: correcting a recipe re-explodes, in the same stroke, the open-period sales that posted through it — never a silent drift between what the recipe says and what the books charged. Reproducibility is the close: its original evidence stays fixed, and a version on which a close still in force relies can only be superseded. Between the two, every consumption movement pins the version that explained it, so the books can always say which standard each row followed.

Each recipe version is a separate record with a unique effective date, its composition fixed while a close still in force has priced consumption through it. A recipe ingredient points either at an item — whose own recipe, if it has one, is resolved by the same date at explosion — or at one specific pinned version of a nested sub-recipe, frozen until the parent is re-versioned. Either way, "explode the recipe as of date D" is deterministic: the same date always yields the same tree. Scheduling may even be backdated (a version's effective date may lie in the past) — and even then, consumption already posted in a sealed period is never re-exploded — while open-period consumption follows the schedule wherever it moves, sealed history stays exactly as priced.

Worked example. A pasta dish used recipe v3 (active from 2026-05-01) until v4 raised the cheese from 30 g to 40 g (active from 2026-06-01). A sale on 2026-05-20 explodes against v3 (30 g cheese) and pins v3 onto its consumption movement; a sale on 2026-06-05 explodes against v4 (40 g). Re-running May's cost of goods next year still uses v3 — the answer never moves.

11. The detail must tie out to the total at every close¶

Rule. At every close, the sum of the detail must equal the controlling total, to the cent: the individual movement rows for a period, added up, must equal the period's controlling balance exactly. Any disagreement is a hard close-blocker.

WHY. The parts must equal the whole, or the books are internally inconsistent and no period total can be trusted — the tie-out is the system catching its own arithmetic before it ships a wrong profit-and-loss. A check that forgave a cent would forgive the first cent of a real error too.

The fractions of a cent a six-decimal price leaves behind are placed on one issue, never smeared, so the identity closes exactly (Costing & valuation says where). A sale that arrives after its period has closed is not edited back into it — that would undo a finished reconciliation — and records revenue on its business date without a stock draw. Reopening that period lays the draw on that date. The system enumerates every blocked row (so nothing hides); the agent only diagnoses and ranks; the operator approves; the deterministic path posts.

Worked example. A period's flour detail sums to €1,402.06 while the controlling balance reads €1,402.10 — a €0.04 gap, so the close refuses and names the pool and the two figures. The next period a made-to-order item turns out to have no recipe in force; its detail can't be valued, so it surfaces as a named, listed close-blocker, not a silent zero — the close waits until a recipe version is in force for the sale's date (its effective date may be set back for exactly this case; sealed history never moves).

12. Sales deplete stock immediately¶

Rule. Stock behind a sale is depleted the instant the sale comes through the door, not deferred to a month-end batch. Every sale line names one item and has exactly one of two depletion behaviors: a stocked item leaves one-for-one in a real unit; a made-to-order item speaks in recipe portions and explodes through the recipe in force on the sale date. Each resulting storage location → customer movement is stamped with the selling restaurant (the profit center) and the warehouse the route resolved to.

WHY. Perpetual inventory means the book reflects reality continuously; deferring depletion to the close would leave on-hand and food cost wrong all month and would collapse the count-versus-book variance the close depends on.

For a made-to-order line, routing is resolved leaf by leaf: a leaf's own override, then the sold item's station as the restaurant maps it, then the restaurant's default storage location. A directly sold stocked item is stationless and uses its own override or the default. Every answer remains inside the selling restaurant's selected consumption warehouse. Routing changes preserve captured consumption quantities and immediately correct eligible open placements; closed or opening-absorbed facts retain their existing draws (sales and consumption).

A comped plate is a sale at €0 — the customer transaction happened, so it posts exactly like a paid sale, cost without revenue. Consumption that was never customer-facing — a staff meal, a recipe test — is internal consumption, its own document with a wider admission rule: stock depletes directly at value, a counted consumable depletes directly at zero value, and a made-to-order item explodes in portions. Its consumption category decides the destination: eaten posts to the customer side; used up posts to scrap. The sales predicate never narrows this internal-use door.

A sale line that cannot resolve to a sellable item is held — left out of the journal, never silently costed at zero. The same applies when a made-to-order item has no recipe in force on its sale date. That missing recipe is a close-blocker until the dated recipe exists, unless the sale date is already sealed. An unanswered required build choice holds the sales line as well.

Worked example. A till sends order #4417 (2× pasta). On arrival it is recorded once under the source id 4417; the pasta item explodes (date-correct) into leaf consumption movements posted immediately, stamped with the selling restaurant and the routed consumption warehouse. The till retries the same batch an hour later: id 4417 already exists, so it is skipped. On-hand reflects the sale once, in real time.

13. The book never refuses a fact¶

Rule. A document that records something that already happened — a sale, a transfer, a write-off, a production batch — posts no matter what the book says is on hand. The issue is valued at the pool's own price, struck on what has come in; where nothing has come in there is nothing honest to charge, so the issue is worth zero until a delivery says otherwise. The pool may run negative between reconciliations. The guard sits at the close, not the door: a warehouse whose book is negative will not close until the missing receipt, or the count that explains the gap, has arrived. What the door never refuses is a shortage — it does still refuse a class: an oven sent to the books that keep flour is not a fact about a quantity but a line in the wrong set of books, and no later count could reconcile it (see Scope & locations).

WHY. The book is a claim assembled from delayed, imperfect paperwork — receipts post days late, journals are filled by different hands — while the person holding the goods is reporting reality. Refusing the record puts nothing back in the walk-in; it only hides the fact and makes two books wrong at once (the source still claims stock that left, the destination never learns what arrived). A recorded deficit is a visible debt the next receipt or count settles.

A storage location inside the warehouse may read negative when movements outrun the paperwork. The pool is reconciled by a receipt or count; a location by the count's relocation.

Worked example. The book says 6 kg of flour at the commissary; the cook has already carried 10 kg to the bar store and records the transfer. It posts: the commissary's pool goes to −4 kg at its €0.85 price, the bar store takes in +10 kg at €0.85. Tomorrow the overdue 25 kg receipt posts and lifts the deficit — or the next count finds where the paper went wrong. Had the record been refused, the commissary would still claim 6 kg it does not have, and the bar store would be selling flour its book never received.

14. Food attributes never touch on-hand or value¶

Rule. Nutrition, allergens, and shelf-life post no stock movement and never change on-hand or weighted-average cost.

WHY. "What is this food, and how long does it keep?" and "how much do I have, and what did it cost?" are different domains; coupling them is how a system grows a nutrition-staleness bug and a fridge-only shelf-life afterthought — keeping food attributes off the journal keeps both sides correct.

Food attributes ride the same recipe-tree roll-up that costing uses (rule 16), not the journal of movements.

15. A made item keeps no longer than its shortest-lived component¶

Rule. The advisory shelf-life cap of a made item is the minimum over its recipe-tree components of their remaining life — the most-restrictive-component rule — and it is computed on the shared roll-up, not merely asserted in prose.

WHY. A dish cannot be safe for longer than its fastest-spoiling sub-recipe; a long-lived dressing must not extend a short-lived cooked-protein component — so the cap has to be derived from the tree, not declared.

Worked example. A grain bowl uses a cooked-chicken sub-recipe good for 3 days and a dressing sub-recipe good for 7. The bowl's advisory cap is min(3, 7) = 3 days. If the chicken sub-recipe's own recipe changes and its cap drops to 2, the next roll-up drops the bowl to 2 — through the very same invalidation that refreshes nutrition (rule 16).

Rule. Cost, nutrition, allergens, and the shelf-life cap share the same recipe versions, traversal, yield facts, and one ancestor-invalidation; no attribute gets a private composition graph of its own. On a matrix, canonical food attributes use the base build while cost may use a concrete build. Each computed profile stamps its provenance — its source, the recipe version it was computed from, and when.

WHY. A second, separate recompute path is exactly how nutrition goes stale — it fails to fire when a child sub-recipe changes, and a dish shows calories from an old version of a component. One spine plus one invalidation makes a "one attribute stale while the others are fresh" state structurally impossible, and the version stamp makes any staleness detectable.

17. Receiving dates remain facts¶

Rule. Changing catalogue shelf life does not rewrite the use-by dates recorded on receiving lines. Date corrections follow Procurement.

18. Food-safety rules are data, not buried numbers¶

Rule. The shelf-life policy — which combinations of risk flags map to how many days, each rule citing its food-safety source — is versioned, shared data keyed by jurisdiction, never numbers hard-baked into the logic. And the language model that reads a recipe is forbidden from emitting a day number: it only assigns risk flags; the deterministic policy table turns flags into days.

WHY. Food codes differ by region and change over time; baking them in forces a code change to tune a single day-cap and blocks a second jurisdiction outright. Keeping the language model out of the number keeps the safety math auditable and testable — the same two-stage discipline costing uses to keep the model out of the money math.

Worked example. A cooked-chicken sub-recipe is classified with the flags cooked-protein and rapidly-chilled; the model never says "4 days." The policy table — first-match-wins, most-restrictive-first — maps that flag combination to a recommended and a maximum number of days, each rule citing its source. A jurisdiction with a stricter code ships a different version of the table; not a line of logic changes.

19. The selling surface never gates the ledger¶

Rule. A sales ticket is a ledger fact — lines, quantities, money — and nothing on the selling surface conditions its ingest, posting, or correction. Storefront attribution is optional enrichment, freely re-pointed at any time (a re-point moves channel reporting and nothing else — movements, money, and each line's recorded menu item stay as posted). A stop never blocks a sale from posting: it shapes what storefronts show, not what the books record.

WHY. A business may sell through channels never connected to the selling surface at all — the fact of a sale cannot be held hostage to that surface's adoption. And a marketplace that sold an 86'd dish before its page refreshed produced a real sale; refusing it would make the books lie about ingredients that genuinely left.

Worked example. A spreadsheet of last month's sales posts with no storefront on any ticket. A week later the operator attributes one fully posted ticket to "Nonna — Glovo": the ticket now reports under Glovo, and not a single movement, cost, or recorded menu item changes.

20. A publication never changes¶

Rule. Publishing freezes a menu into a version effective from a moment, and the frozen document is immutable — complete in every configured language, never edited. Only a version whose moment has not arrived can be withdrawn; a document that has served customers is superseded by publishing anew, never unpublished. Publishing into the past is refused.

WHY. Sales arrive late — sometimes weeks late through an integration — and they must resolve against the exact document the customer saw. An editable or backdatable publication would let today's prices rewrite yesterday's evidence.

Worked example. Lunch prices publish at 11:00, dinner prices at 17:00 the same day. A 12:30 delivery order back-reported two days later still resolves against the 11:00 document — the timeline answers with what was in force, not with what is current.

21. One live placement per exact target; the most specific wins¶

Rule. Each exact placement target — a whole channel, or one storefront — carries at most one live placement, and where both grains cover a storefront, the storefront-grain placement applies whole: its menu, its price band, its override sheet. Bands and overrides never stack across grains.

WHY. Two rules on one target would make what a customer sees — and what a late sale resolves against — depend on evaluation order; one-per-target with most-specific-wins keeps "what does this storefront serve?" a question with exactly one answer.

Worked example. The Glovo channel carries the Delivery menu at +30%; the storefront "Nonna — Glovo" carries the Nonna menu with its own band. The Nonna page serves Nonna under Nonna's band alone; every other Glovo storefront serves Delivery at +30%; deleting the Nonna placement lets the channel rule cover that page again.

22. An option names what it does; it never owns composition¶

Rule. A modifier option carries a customer-facing choice, a signed price move, the catalog item it talks about where one is needed, and one meaning: choose, remove, sell on the side, or sell instead of the menu target. It carries no recipe quantity. The option itself has no catalog identity; an add-on or variant sells its named item, while a choice or removal resolves that item against the target's recipe matrix.

WHY. Quantities and technique are production truth, while selection bounds and prices are commercial truth. Catalog item identity is their one shared point; putting amounts on both documents creates two answers that can drift.

Worked example. A latte sells at €3.50; the «Milk» group offers oat at +€0.50 and names the oat-milk item. The latte recipe alone says that candidate is 150 ml. The choice seats it without repeating 150 ml in the menu.

23. One catalog item has one place in a recipe version¶

Rule. The same item may appear in only one place in one recipe version — one ordinary line or one candidate of one slot. An owned sub-recipe counts as its owner item for this rule.

WHY. A choice crosses from menu to recipe through item identity. If the same item stood in two places, "choose oat milk" would not say which place to change, and the same order could resolve to two different builds.

Worked example. Oat milk cannot be both an addable line and a candidate of the milk slot in one latte recipe. Put it in the slot, where one choice has one answer.

24. A recipe matrix is made-to-order; a slotted recipe is never nested¶

Rule. A recipe with slots, removable lines, or addable lines belongs only to a made-to-order item. A recipe with slots cannot be used as a component of another recipe, in either the live or pinned nesting mode.

WHY. Production of stock and explosion of a parent recipe happen without a customer present to answer a hidden choice. Allowing a slotted recipe there would either guess a build or leave the quantity book dependent on an unanswered question.

Worked example. A breakfast may offer omelette, fried eggs, or poached eggs as owned sub-recipe candidates in its eggs slot. None of those candidate recipes may itself hide a second slot; that choice must be raised into the breakfast matrix.

25. A warehouse begins with one date and one set of initial balances¶

Rule. Initial quantities by storage location and their costs describe the warehouse at the beginning of its opening date. Omitted items start at zero; all movements dated that day belong to the first period. The opening remains correctable until the first close and stays fixed while any close remains in force. A storage location added after a close starts at zero.

WHY. All storage locations share one warehouse's books, and their common beginning keeps a relocation on the same side of the boundary at both ends. Initial balances explain stock already held when those books began; a fresh starting value declared later would create value without an acquisition.

Worked example. The warehouse begins 1 June with 20 kg of flour in the cellar and zero at the bar. A 3 kg relocation on 1 June leaves 17 kg and 3 kg respectively. A new storage location created after June closes also begins at zero; the next transfer brings its quantity and value with it.

26. Publication serves daily quantities; completeness serves the close¶

Rule. Between closes, an item's running quantity at a storage location stands on its latest posted full or spot observation, plus movements after that day. A draft supplies no published observation, and a published incomplete count affects only what it explicitly counted. Publishing a count does not move the pool's price: it stands on the preceding close or the warehouse's initial balances, plus the period's arrivals, and shrinkage is expensed only by a close. The close, the reconciliation, and their previews read the selected full counts, draft or posted. Completeness follows the initial or settled balance and dated movements, independently of publication; other operational observations do not add required items. Only complete evidence can settle a period. A full count chosen to supply initial quantities serves that separate purpose as taught in Period close §4.

WHY. The running book exists to keep the balances people order and cook against honest, so the freshest observation the operator published should govern it. The close exists to account for every required item, so deliberate selection and full coverage govern it. Changing the facts that require coverage changes completeness, not the operator's publication decision.

Worked example. A complete draft full count on the 12th records 18 kg of flour. A spot count on the 20th records 15 kg and is posted. Daily flour reads 15 kg plus later movements, while the accountant can choose the draft of the 12th as closing evidence. The close settles its 18 kg without publishing that draft, and reopening leaves it a draft.