Review the overdue regulatory records

RISK-REG-0001: eight-year voucher period (BEG IV) confirmed against
secondary sources and §147 AO. RISK-POL-0009/0002: positions unchanged; new
restore evidence noted as partial. RISK-POL-0012: receiving duty still
unowned; issuing phase-in dates added, flagged for confirmation.
RISK-POL-0011: stays dormant.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 6903@bnt-lap001
Assistant-Session: 8319e8a8-ffa6-4eb3-b8bf-b29945628f89

docs/regulatory/audit-retention-basis.md

@@ -6,13 +6,13 @@ status: determined-internally
 owner: risk-nexus
 determined: "2026-08-20"
 finding: RISK-F-0008
-sources_read: "GDPR Arts 5, 6, 17, 21, 32; Recitals 49, 65; HGB §257; AO §147"
+sources_read: "GDPR Arts 5, 6, 17, 21, 32; Recitals 49, 65; HGB §257; AO §147; BEG IV (BGBl. 2024 I Nr. 323) secondary summaries"
 external_review: none
-last_checked: "2026-09-02T08:11:18Z"
+last_checked: "2026-09-22T06:25:39Z"
-next_check: "2026-09-02T09:11:18Z"
+next_check: "2026-09-22T14:25:39Z"
-cadence: 1h
+cadence: 8h
-clean_streak: 1
+clean_streak: 2
-checked_by: "grok/risk-nexus"
+checked_by: "worsch"
 ---
 
 # RISK-REG-0001 — the retention basis, written down
@@ -138,7 +138,7 @@ can argue with is stronger than an honest blank.
 | --- | --- | --- |
 | Operator and agent security audit records | **12 months** | Art 6(1)(f) with Art 32. Twelve months covers an annual review cycle and the ordinary lag between an incident happening and being discovered. Longer needs a specific reason, per record class, not a habit. |
 | Counterparty transaction evidence | **3 years, running to the end of the third calendar year** | Art 17(3)(e), defence of legal claims, tracking the general German limitation period (§195, §199 BGB — three years from the end of the year in which the claim arose). Evidence outliving the claim it could defend has no ground. |
-| Accounting vouchers (*Buchungsbelege*) | **8 years** | §147 AO / §257 HGB. Shortened from ten years by the Fourth Bureaucracy Relief Act with effect from 2025. **Worth confirming before relied on** — it is recent and this repo has not verified it against the current text. |
+| Accounting vouchers (*Buchungsbelege*) | **8 years** | §147 AO / §257 HGB. Shortened from ten years by the Fourth Bureaucracy Relief Act (BEG IV, promulgated 2024-10-29) with effect from 2025-01-01, including vouchers whose period had not expired by then. Confirmed 2026-09-22 against secondary sources (Haufe, datenschutz-notizen) and the `gesetze-im-internet.de` text of §147 AO. This is not a qualified review. |
 | Books, inventories, annual accounts | **10 years** | §257 HGB, unchanged by that reform. |
 | Commercial and business letters | **6 years** | §257 HGB. |
 | Personal data in audit records falling in none of the above | **delete** | No ground identified means no retention. The operator's minimisation ruling of 2026-08-20 should mean this category is close to empty by construction. |
@@ -169,8 +169,6 @@ table as a compliance claim.
 - **A keyed commitment working** (`RISK-F-0008`). Then erasure becomes
   available and the retention argument narrows to the retained-by-obligation
   rows only, which are the strong ones.
-- **Confirmation of the eight-year voucher period.** Flagged above; the rest of
-  the table does not depend on it.
 - **Any of the three triggers** for buying an external determination, which
   remain unruled.
 
@@ -180,3 +178,4 @@ unresolved.
 
 - **2026-09-01** — not clean: the dated review found that the 2026-08-20 target-period amendment had never advanced this record's check state. The targets now stand explicitly; achievement under the shared backup horizon and keyed-commitment feasibility remain open. Cadence 1h → instant; checked again immediately.
 - **2026-09-02** — clean check: grounds and target periods unchanged; still waiting on the platform-pg co-residency horizon. Cadence instant → 1h (1 clean in a row); next check 2026-09-02 09:11Z.
+- **2026-09-22** — clean check: Grounds and target periods unchanged; eight-year voucher period (BEG IV, from 2025-01-01) confirmed against secondary sources and AO §147; audit-core co-residency horizon and keyed commitment unchanged since 2026-09-02. Cadence 1h → 8h (2 clean in a row); next check 2026-09-22 14:25Z.

docs/regulatory/policies/RISK-POL-0002-retention-and-erasure.md

@@ -8,10 +8,11 @@ activates_when: "any personal data is held — the commercial half (RISK-POL-000
 owner: risk-nexus
 written: "2026-08-20"
 related: [RISK-POL-0009, RISK-REG-0001, RISK-F-0008]
-cadence: instant
+cadence: 1h
-clean_streak: 0
+clean_streak: 1
-last_checked: "2026-08-20T21:30:00Z"
+last_checked: "2026-09-22T06:26:12Z"
-next_check: "2026-08-20T21:30:00Z"
+next_check: "2026-09-22T07:26:12Z"
+checked_by: "worsch"
 ---
 
 # RISK-POL-0002 — retention and erasure
@@ -61,3 +62,19 @@ and verified co-residency horizon; a demonstrated restore proving the retained
 side works too.
 
 None of those exist yet, and `RISK-F-0008` carries the gap.
+
+**2026-09-22 review.** The position is unchanged and `RISK-F-0008` still
+carries the gap. Two partial inputs have arrived since 2026-08-20:
+
+- `audit-core` (AUDIT-WP-0008) states it declares nothing above the 30-day
+  `platform-pg` default and will not extend any co-resident's horizon. That is
+  a *stated* contribution to the co-residency horizon. It does not verify the
+  instance maximum, which also depends on the other co-residents and on backup
+  retention.
+- Restores from the retained side are demonstrated for `apps-pg` and Forgejo
+  (RPF-WP-0029, RPF-WP-0038). That shows the retained side works, but it
+  proves no deletion at expiry.
+
+## Reviews
+
+- **2026-09-22** — clean check: Position unchanged; audit-core states a 30-day contribution (unverified instance maximum); restore evidence exists, no deletion evidence; F-0008 carries the gap. Cadence instant → 1h (1 clean in a row); next check 2026-09-22 07:26Z.

docs/regulatory/policies/RISK-POL-0009-commercial-and-tax-retention.md

@@ -7,10 +7,11 @@ status: active
 activates_when: "the estate keeps commercial books or issues and receives invoices — already true"
 owner: risk-nexus
 written: "2026-08-20"
-cadence: instant
+cadence: 1h
-clean_streak: 0
+clean_streak: 1
-last_checked: "2026-08-20T21:30:00Z"
+last_checked: "2026-09-22T06:26:01Z"
-next_check: "2026-08-20T21:30:00Z"
+next_check: "2026-09-22T07:26:01Z"
+checked_by: "worsch"
 ---
 
 # RISK-POL-0009 — commercial and tax retention
@@ -31,9 +32,11 @@ made or the document created — not from the document's own date. That detail
 is the one most often got wrong, and it always extends the period rather than
 shortening it.
 
-**The eight-year figure is recent and this repo has not verified it against the
+**The eight-year figure was confirmed on 2026-09-22** (see `RISK-REG-0001`). It
-current text.** Confirm before relying on it for a deletion decision; ten years
+comes from BEG IV, promulgated 2024-10-29, and has applied since 2025-01-01,
-is the safe reading if nobody has.
+including to vouchers whose period had not run out by then. This rests on
+secondary sources and the published §147 AO text, not on a qualified review.
+Books and annual accounts stay at ten years.
 
 ## What it requires of systems
 
@@ -64,3 +67,16 @@ retained period; a deletion routine that actually runs at expiry.
 None of those exist yet. This policy is `active` in the sense that the duty
 applies, not in the sense that it is demonstrably satisfied — and the register
 says which.
+
+**2026-09-22 review.** Some new evidence exists but it does not satisfy the
+duty. Restores are now proven for `apps-pg` from the Scaleway primary and for
+Forgejo from the Nextcloud secondary (RPF-WP-0029, RPF-WP-0038). Neither is a
+restore from the oldest retained period, and neither lane holds books or
+vouchers as a named record class. The secondary lane's 10 GiB quota holds about
+two archives, which is far short of an eight-year horizon. There is still no
+retention schedule and no expiry deletion routine, so the position above is
+unchanged.
+
+## Reviews
+
+- **2026-09-22** — clean check: Position unchanged: duty applies, not demonstrably met; eight-year voucher period confirmed; new restore evidence (apps-pg, Forgejo) does not cover book/voucher classes or the oldest period. Cadence instant → 1h (1 clean in a row); next check 2026-09-22 07:26Z.

docs/regulatory/policies/RISK-POL-0011-accessibility.md

@@ -7,10 +7,11 @@ status: dormant
 activates_when: "a consumer-facing digital service or product is offered in Germany — e-commerce, banking, e-books, ticketing, or a consumer app"
 owner: risk-nexus
 written: "2026-08-20"
-cadence: instant
+cadence: 1h
-clean_streak: 0
+clean_streak: 1
-last_checked: "2026-08-20T21:30:00Z"
+last_checked: "2026-09-22T06:26:29Z"
-next_check: "2026-08-20T21:30:00Z"
+next_check: "2026-09-22T07:26:29Z"
+checked_by: "worsch"
 ---
 
 # RISK-POL-0011 — accessibility
@@ -58,3 +59,11 @@ statement; automated and manual test results in the release path.
 Nothing here binds any repo today. `whynot-design` and the consumer-domain
 repos are where it will land, and naming the owner is theirs, not the
 register's.
+
+**2026-09-22 review.** The policy stays dormant. No consumer-facing digital
+service offered in Germany is on record. The micro-enterprise exemption for
+services is still the fragile basis described above.
+
+## Reviews
+
+- **2026-09-22** — clean check: Dormant: no consumer-facing service on record. Cadence instant → 1h (1 clean in a row); next check 2026-09-22 07:26Z.

docs/regulatory/policies/RISK-POL-0012-e-invoicing.md

@@ -7,10 +7,11 @@ status: active
 activates_when: "the estate is a German business receiving B2B invoices — already true"
 owner: risk-nexus
 written: "2026-08-20"
-cadence: instant
+cadence: 1h
-clean_streak: 0
+clean_streak: 1
-last_checked: "2026-08-20T21:30:00Z"
+last_checked: "2026-09-22T06:26:29Z"
-next_check: "2026-08-20T21:30:00Z"
+next_check: "2026-09-22T07:26:29Z"
+checked_by: "worsch"
 ---
 
 # RISK-POL-0012 — e-invoicing
@@ -53,3 +54,18 @@ structured form, retrievable at eight years.
 Not established. If a supplier sends one tomorrow, nobody here can say what
 happens to it — which is a small, ordinary, entirely fixable gap, and exactly
 the kind that only becomes visible when it is written down.
+
+**2026-09-22 review.** The position is unchanged. The receiving duty is live
+and still has no named owner in the estate, five weeks after this record was
+written. The issuing dates under §27(38) UStG are:
+
+- **2027-01-01** for businesses with prior-year turnover above EUR 800,000;
+- **2028-01-01** for everyone else.
+
+A turnover below the threshold therefore leaves about fifteen months, not
+three. This is from general knowledge of the Wachstumschancengesetz and has
+not been re-read against the current text. Confirm it before planning to it.
+
+## Reviews
+
+- **2026-09-22** — clean check: Receiving duty live, still no named owner; issuing phase-in dates noted (2027/2028), to be confirmed. Cadence instant → 1h (1 clean in a row); next check 2026-09-22 07:26Z.