# AARJAY GDP Portal — Commercial Pilot Directive Response

**Product claim (mandatory):**  
GDP-oriented wholesale operations and quality-management support system.

**Next release identity (mandatory):**  
**AARJAY GDP Portal Commercial Pilot v1.0 — Controlled Validation Candidate**

**Assessment date:** 19 July 2026  
**Codebase:** `/Users/sagar/Downloads/AARJAY_GDP_Portal/mvc`  
**Current schema floor:** 286  
**Current VERSION.txt:** v15.8 (2026-07-11) — **retire for commercial use**  
**Architecture today:** Isolated single-tenant application (site-scoped). Not multi-tenant SaaS.  

**Interactive plan canvas:** open beside chat — `commercial-pilot-directive-plan.canvas.tsx`

---

## 0. Standing rules (accepted)

1. Stop non-essential modules until Commercial Pilot v1.0 meets §17 acceptance.
2. Do **not** claim MHRA approval, guaranteed GDP compliance, inspection success, or RP substitution.
3. Customer organisation + RP remain responsible for approving the configured system for use.
4. Prefer **isolated single-tenant** deployments for the first commercial customers.
5. Shared multi-tenant SaaS is **out of scope** until formal isolation design + penetration testing exist.

---

## 1. Directive coverage matrix (every requirement)

Status key:

| Status | Meaning |
|--------|---------|
| **Implemented** | Meets commercial-pilot intent with evidence in code |
| **Partial** | Foundation exists; gaps block “production-ready pilot” claims |
| **Not implemented** | Missing |
| **Requires redesign** | Exists but AARJAY-coupled / structurally wrong for product |
| **N/A** | Explicitly deferred |

| ID | Directive § | Requirement | Status | Seq | Primary files |
|----|-------------|-------------|--------|-----|---------------|
| R-01 | 1 | Commercial Pilot release identity | Partial | P1.0 | `VERSION.txt`, `SystemHealth`, `scripts/run_migrations.php` |
| R-02 | 2 | Isolated single-tenant model | Implemented | P2/P3 ops | Deploy model (site-scoped DB; no portal `tenant_id`) |
| R-03 | 3.1 | Runtime extended permissions | **Implemented (P1.1)** | P1.1 | `Auth.php`, controllers, `PermissionSeeder`, `phase11_extended_rbac_test.php` |
| R-04 | 3.2 | E-sign ↔ operational TX bind | **Implemented (P1.2)** | P1.2 | `EsignService` defer/finalize; Dispatch/GRN/CAPA/StockBatch; `phase12_esign_bind_test.php` |
| R-05 | 3.3 | Universal Stock Ledger | **Implemented (P1.3)** | P1.3 | Recall/Defective/Falsified/NonSaleable → `recordMovement`; `phase13_universal_ledger_test.php` |
| R-06 | 3.4 | Dispatch duplicate batch control | **Implemented (P1.4)** | P1.4 | Aggregate-by-batch in `processStockMovementsOnDispatch`; `phase14_dispatch_dup_batch_test.php` |
| R-07 | 3.5 | Evidence download authorisation | Partial | P1.5 | `FileController.php`, `EvidenceService.php` |
| R-08 | 3.6 | Evidence version retention (no unlink) | Partial | P1.6 | SoftLifecycle; `@unlink` in Dispatch/SOP/DocControl/etc. |
| R-09 | 3.7 | Expanded evidence metadata + SHA-256 | Partial | P1.6 | `UploadHelper.php` vs `EvidenceAttachment` persistence |
| R-10 | 3.8 | Fail-fast migrations; no prod force-reinstall | Partial | P1.7 | `InstallController.php`, `scripts/run_migrations.php` |
| R-11 | 3.9 | Valid signed release package | Partial | P1.8 | `package_release.sh`, `verify_release.sh`, manifests |
| R-12 | 3.10 | Full backup/restore (DB+evidence+proof) | Partial | P1.9/P3 | `backup_*.sh`, `restore_*.sh`, `prove_restore.sh` |
| R-13 | 3.11 | Signed/MFA authority delegation | Partial | P1.10 | `AuthorityDelegationService.php` (`approval_signature_id` unused) |
| R-14 | 3.12 | Strengthened Trade Gate + no runtime DDL | Partial | P1.11 | `TradeGateService.php`, mig **284** |
| R-15 | 4 | Org configuration / de-AARJAY | Requires redesign | P2.1 | `SiteSetting*`, site labels, SOP options, MFA issuer |
| R-16 | 5 | 8-step onboarding wizard | Not implemented | P2.2 | Install + company wizard only |
| R-17 | 6 | Demo/Dev/Staging/Production modes | Partial | P2.3 | `config.php` `app.env`; no dedicated Demo mode |
| R-18 | 7 | Commercial v1 module scope + flags | Partial | P2.4 | `FeatureFlags.php`; nav still broad |
| R-19 | 8 | Eliminate dual/legacy workflows | Partial | P2.5 | `MODULE_REGISTRY.md` stale |
| R-20 | 9 | Role-based dashboards | Partial | P2.6 | Generic dashboard; RP/Inspector portals partial |
| R-21 | 10 | Hosting & monitoring standard | Not implemented | P3.1 | Docs/ops TBD |
| R-22 | 11 | Controlled updates per install | Not implemented | P3.2 | Install/release records TBD |
| R-23 | 12 | Export + offboarding | Not implemented | P3.3 | Operational CSV only |
| R-24 | 13 | Validation assistance pack | Partial | P3.4/P4 | `docs/validation/*_TEMPLATE.md` |
| R-25 | 14 | Customer + technical documentation | Partial | P3.5 | Partial; outdated instructions to purge |
| R-26 | 15 | Support process | Not implemented | P3.6 | Commercial ops TBD |
| R-27 | 16 | Security/privacy + legal pack | Not implemented | P3.7 | Solicitor-reviewed (external) |
| R-28 | 17–18 | Pilot acceptance + go-live | Not implemented | P4 | Execution phase |
| R-29 | 2 | Shared multi-tenant SaaS | N/A | Post-v1 | Explicitly deferred |

**Weighted readiness (rough):** ~40–45% of actionable items; strong staging/validation candidate foundation, not commercial-pilot-ready.

---

## 2. Phase plan (sequence first, not calendar estimates)

```
P1 Controls → P2 Productise → P3 Commercial ops → P4 Pilot validation → Pilot go-live
```

Broad marketing **blocked** until P4 acceptance evidenced.

### Phase 1 — Remaining technical controls (start immediately)

| Seq | Work package | Dependencies |
|-----|--------------|--------------|
| P1.0 | New release identity fields + retire v15.8 for commercial naming | None |
| P1.1 | Enforce extended permissions at controllers/services | P1.0 helpful |
| P1.2 | Atomic e-sign + operational bind (all critical paths) | P1.1 |
| P1.3 | Universal Stock Ledger / Stock State | P1.2 (shared TX patterns) |
| P1.4 | Dispatch duplicate-batch rule | P1.3 |
| P1.5 | Evidence ACL fail-closed | P1.1 (download/export perms) |
| P1.6 | Evidence versioning + metadata migration | P1.5 |
| P1.7 | Installer/migration engine harden | None (parallel after P1.1) |
| P1.8 | Rebuild signed package verify-on-extract | P1.7 + freeze |
| P1.9 | Expand backup/restore proof (DB+evidence) | P1.6 |
| P1.10 | Delegation e-sign + MFA | P1.2 |
| P1.11 | Trade Gate structured conditions; remove runtime CREATE | P1.2 |
| P1.12 | True concurrency + stock regression suite | P1.3–P1.4 |

### Phase 2 — Productisation

| Seq | Work package |
|-----|--------------|
| P2.1 | Organisation configuration + remove hardcodes |
| P2.2 | 8-step onboarding wizard |
| P2.3 | Demo / Dev / Staging / Production modes |
| P2.4 | Nav scope + feature flags + module register lifecycle |
| P2.5 | Legacy workflow archive/deprecate |
| P2.6 | Role home pages |

### Phase 3 — Commercial operations

| Seq | Work package |
|-----|--------------|
| P3.1 | Hosted deployment + monitoring spec |
| P3.2 | Controlled update procedure + per-install records |
| P3.3 | Customer export + offboarding |
| P3.4 | Validation assistance pack (supplier vs customer) |
| P3.5 | Dual documentation sets + Engineering Standard |
| P3.6 | Support severity model (no SLA overpromise) |
| P3.7 | Security/privacy drafts → solicitor review |

### Phase 4 — Pilot validation

Clean pilot env → config → data migrate → IQ/OQ → multi-role UAT → training → RP release → controlled go-live.

---

## 3. Detailed work packages (directive-required fields)

For each Phase 1 package: status, files, DB impact, proposal, security, GDP, tests, deps, acceptance evidence, risks.

---

### P1.0 — Commercial release identity

| Field | Content |
|-------|---------|
| **Status** | Partial |
| **Files** | `VERSION.txt`, `SystemHealth.php`, `scripts/run_migrations.php`, new `app/Services/ReleaseIdentity.php`, optional mig **288** `installations` / `release_records` |
| **DB** | Tables: `installation_id`, `product_version`, `schema_floor`, `manifest_fingerprint`, `environment`, `customer_org_name`, `release_status`, `source_commit`, `build_date` |
| **Proposal** | Replace commercial identity with `1.0.0-pilot` + `controlled_validation_candidate`. Surface on System Health + footer. |
| **Security** | Install ID unique per env; no shared secrets across customers |
| **GDP** | Supports change control / inspectable version reconstruction |
| **Tests** | Health endpoint returns all identity fields; mismatch fails health check |
| **Deps** | None |
| **Acceptance** | No “v15.8” on commercial artifacts |
| **Risks** | Confusing historical tags — document archive only |

---

### P1.1 — Extended permission enforcement

| Field | Content |
|-------|---------|
| **Status** | Partial (schema/UI/seeder yes; runtime mostly edit/view) |
| **Files** | `app/Core/Controller.php`, `app/Helpers/Auth.php`, `PermissionSeeder.php`, Dispatch/GRN/CAPA/Report/Trade/Stock controllers |
| **DB** | Likely none (mig **285** already). Seed review only |
| **Proposal** | For regulated actions stop falling back to `edit`. Call `requireAccess($mod,$action)`. Include site, record status, role, delegation, competency hooks where already modelled. **Admin ≠ RP.** |
| **Security** | Closes privilege escalation via UI/API status transitions |
| **GDP** | Aligns electronic control with defined duties |
| **Tests** | Matrix: release/approve/sign/void/export/override; Viewer write denial; cross-site denial; Warehouse cannot RP-release |
| **Deps** | Permission matrix documentation |
| **Acceptance** | Grep shows regulated gates use action names; automated permission tests green |
| **Risks** | Breaking existing roles — ship with updated role templates + migration seeder patch |

---

### P1.2 — E-sign / operational atomic bind

| Field | Content |
|-------|---------|
| **Status** | Partial (Dispatch/GRN/Trade strong; CAPA weak) |
| **Files** | `EsignService.php`, `MfaService.php`, Dispatch/GRN/CAPA/Quarantine controllers/models |
| **DB** | Ensure content_hash/version columns present (mig **284**); possibly `record_version` bumps |
| **Proposal** | Documented 10-step TX. Reject stale hash. Failed transition = no retained successful signature. Extend to CAPA close, quarantine release. |
| **Security** | MFA + authority inside same TX as status change |
| **GDP** | Signature meaning bound to exact reviewed content |
| **Tests** | Mid-sign content change rejected; rollback leaves no valid e-sign; MFA missing blocked |
| **Deps** | P1.1 |
| **Acceptance** | All high-risk meanings require `canonical_payload` |
| **Risks** | UX friction — mitigated with clear re-review prompts |

---

### P1.3 — Universal Stock Ledger

| Field | Content |
|-------|---------|
| **Status** | Partial |
| **Files** | `StockLedgerService.php`, `StockBatch.php`, `Recall*`, `DefectiveStock.php`, `FalsifiedMedicine.php`, `NonSaleableStock.php`, Return/Transfer (already ok) |
| **DB** | Possibly reason/status enums; no dual writers |
| **Proposal** | Ban direct `INSERT stock_batch_movements` / controlled status updates outside ledger/state service. Add state transitions for quarantine/recall/defective/write-off/destruction. |
| **Security** | Idempotency + row locks reduce race abuse |
| **GDP** | Single reconstructable stock truth |
| **Tests** | Recall-vs-dispatch concurrency; reconciliation; no negative stock route |
| **Deps** | P1.2 patterns |
| **Acceptance** | Static search: zero bypass writers |
| **Risks** | Legacy data mid-state — migration reconciliation script |

---

### P1.4 — Dispatch duplicate batch

| Field | Content |
|-------|---------|
| **Status** | Partial |
| **Files** | `Dispatch.php`, Dispatch UI |
| **DB** | Optional unique `(dispatch_id, batch_id)` or line-level idempotency key |
| **Proposal** | Prefer: unique batch per dispatch **or** aggregate qty before post; include Dispatch Item ID in idempotency key if multi-line allowed |
| **Security** | Prevents under-post via replay/idempotency collision |
| **GDP** | Accurate batch allocation evidence |
| **Tests** | Two lines same batch → correct total deduct; reject or aggregate per rule |
| **Deps** | P1.3 |
| **Acceptance** | Dedicated duplicate-batch test green |
| **Risks** | UX if aggregation unexpected — document chosen rule |

---

### P1.5–P1.6 — Evidence ACL, versioning, metadata

| Field | Content |
|-------|---------|
| **Status** | Partial |
| **Files** | `FileController.php`, `EvidenceService.php`, `EvidenceAttachment.php`, UploadHelper, controllers that `@unlink` |
| **DB** | Mig **287**: checksum, installation_id, confidentiality, predecessor_id, retention, verified_*, mime, status |
| **Proposal** | Authorise only via evidence DB row. Fail closed. Replace = new version + supersede previous; retain bytes. Physical delete only temp/malware/retention/legal. |
| **Security** | Stops path-traversal / guessable URL leaks; Inspector expiry |
| **GDP** | Inspection reconstruction of superseded docs |
| **Tests** | Unauthorised download blocked; supersede retains checksum; restore reconciles files↔rows |
| **Deps** | P1.1 for download/export |
| **Acceptance** | No `@unlink` on committed regulated paths |
| **Risks** | Storage growth — retention policy required |

---

### P1.7 — Fail-fast installer / migrations

| Field | Content |
|-------|---------|
| **Status** | Partial (CLI fail-fast exists; browser installer caveats) |
| **Files** | `InstallController.php`, `scripts/run_migrations.php` |
| **DB** | Verification queries for tables/columns/indexes/FKs/triggers/floor |
| **Proposal** | One engine for install/upgrade. Stop on SQL error. Never mark failed as applied. Checksum migrations. Disable production force-reinstall (CLI + change control only). |
| **Security** | Removes public destructive reinstall vector |
| **GDP** | Controlled configuration status |
| **Tests** | Broken migration does not advance floor; verify report produced |
| **Deps** | None |
| **Acceptance** | Forced reinstall impossible when `env=production` without offline procedure |
| **Risks** | Installer UX stricter — intentional |

---

### P1.8 — Signed release package

| Field | Content |
|-------|---------|
| **Status** | Partial (tooling exists; delivered ZIP previously mismatched) |
| **Files** | `scripts/package_release.sh`, `make_manifest.sh`, `sign_manifest.sh`, `verify_release.sh` |
| **DB** | N/A |
| **Proposal** | Freeze → clean → manifest → sign → zip → extract-verify → lint → migrate/tests → only then deliver |
| **Security** | Tamper evidence |
| **GDP** | Supplier validation evidence |
| **Tests** | `verify_release.sh` 100% on extracted tree |
| **Deps** | Freeze after P1 feature complete |
| **Acceptance** | Extracted package == signed manifest |
| **Risks** | Local artefacts contaminating package — automated exclude list |

---

### P1.9 — Backup / restore

| Field | Content |
|-------|---------|
| **Status** | Partial |
| **Files** | `scripts/backup_database.sh`, `restore_database.sh`, `prove_restore.sh` |
| **DB/FS** | Must include private + legacy evidence volumes, job config, release identity |
| **Proposal** | Single restore unit: DB + evidence + config refs. Prove stock reconciliation, audit chain, checksums, sample workflows. |
| **Security** | Encrypted backup storage (ops); access control |
| **GDP** | Business continuity / inspection |
| **Tests** | Full restore rehearsal checklist green |
| **Deps** | P1.6 |
| **Acceptance** | DB-only restore documented as insufficient |
| **Risks** | Large evidence sets — size/time |

---

### P1.10 — Authority delegation e-sign

| Field | Content |
|-------|---------|
| **Status** | Partial |
| **Files** | `AuthorityDelegationService.php`, Profile grant UI |
| **DB** | Use `approval_signature_id` (mig **286**) |
| **Proposal** | Grant requires grantor auth + scope + sites + actions + dates + reason + content-bound e-sign + MFA + audit. Auto-expire. Admin cannot self-grant RP authority. |
| **Security** | Prevents authority elevation via admin console alone |
| **GDP** | RP control of delegated duties |
| **Tests** | Expired delegation denied; unsigned grant rejected |
| **Deps** | P1.2 |
| **Acceptance** | Grant path calls `EsignService` |
| **Risks** | Operational continuity if RP unavailable — Deputy RP templates |

---

### P1.11 — Trade Gate strengthen

| Field | Content |
|-------|---------|
| **Status** | Partial |
| **Files** | `TradeGateService.php`, override UI |
| **DB** | Mig **290** structured condition fields; remove runtime `CREATE TABLE` |
| **Proposal** | Evaluate full licence/qualification/TA/site/activity/product/suspension/blocking CAPA conditions. Overrides exceptional, scoped, timed, signed, MFA, RP/delegate only. |
| **Security** | Blocks unauthorised supply chain |
| **GDP** | Core wholesale GDP control |
| **Tests** | Expired licence block; conditional permit fields; override expiry |
| **Deps** | P1.2 |
| **Acceptance** | No runtime DDL in service |
| **Risks** | False blocks if data incomplete — onboarding must capture quals |

---

## 4. Phase 2–4 summaries (product / ops / pilot)

### Organisation configuration (P2.1) — Requires redesign

Remove hard-coded AARJAY / Woodhall / Grovehill / RP names / local contacts from UX and seed helpers. Store legal name, WDA(H), branding, timezone, currency, numbering, retention in controlled config/DB.  
**GDP:** customer’s licensed identity on documents. **Security:** avoids cross-customer brand leakage in shared code.

### Onboarding wizard (P2.2) — Not implemented

Eight steps per directive §5 with import templates and RP release step. No developer edits per customer.

### Environments (P2.3) — Partial

Add explicit `demo` mode (banner, fictional data, no external email, reset). Staging marked non-production. Production: HTTPS, malware, MFA policy, installer off, debug off.

### Scope / legacy / dashboards (P2.4–P2.6) — Partial

Feature flags already default experimental off. Need live module register (Active / Add-on / Legacy RO / Deprecated / Experimental / Disabled) and role homes.

### Hosting, updates, export, support, legal (P3) — Mostly not implemented

Operational and commercial workstreams. Legal pack is **solicitor-reviewed** before wider sale.

### Pilot (P4)

First customer isolated environment; full §17 gate checklist signed by RP.

---

## 5. Diagrams (logical)

### 5.1 Commercial deployment (isolated single-tenant)

```text
                    [ Signed vendor release ]
                              |
          +-------------------+-------------------+
          |                   |                   |
   customer-a.domain   customer-b.domain   customer-c.domain
          |                   |                   |
     App+PHP-FPM         App+PHP-FPM         App+PHP-FPM
          |                   |                   |
     MySQL A             MySQL B             MySQL C
     Evidence A          Evidence B          Evidence C
     Secrets A           Secrets B           Secrets C
     Backups A           Backups B           Backups C
     Audit A             Audit B             Audit C
```

### 5.2 Application control architecture (target)

```text
Browser → Controllers
            ├─ requireAccess(module, action) + site + record status
            ├─ RecordAuthorisationService
            ├─ TradeGateService ─► partner eligibility
            ├─ EsignService + MfaService ─► content hash (same TX)
            ├─ StockLedgerService ─► sole stock/qty/status writer
            ├─ EvidenceService ─► sole file gate + versions
            └─ AuditService / ActivityLog (append-only)
```

### 5.3 Evidence / document model (target)

```text
evidence_records
  id, installation_id, site_id, module, record_type, record_id,
  category, original_name, storage_name, mime, ext, size,
  sha256, version, status, confidentiality,
  uploaded_by/at, verified_by/at, retention_rule, review_at,
  predecessor_id, destruction_status

storage/private/{installation}/{yyyy}/{uuid}
supersede: new row + previous.status=superseded (bytes retained)
download: EvidenceService.authorize(user, evidence_id) only
```

### 5.4 Release process

```text
CR → impact → develop → review → automated tests → staging deploy
→ customer UAT (if needed) → validation impact → release approval
→ prod backup → deploy → smoke → rollback window open
→ release notes → monitor
```

### 5.5 Backup / restore process

```text
Backup unit = DB dump (+triggers) + evidence volumes + config refs
            + job config + release identity
Restore = restore unit atomically → prove:
  floor, table/row counts, ledger reconcile, audit chain,
  evidence checksums, login, perms, sample Dispatch/GRN/SOP/QMS
```

### 5.6 Validation plan (supplier vs customer)

| Supplier evidence | Customer evidence |
|-------------------|-------------------|
| Signed package verify | Approved URS |
| Technical/concurrency tests | Configured roles vs SOPs |
| IQ (install) assistance | UAT / PQ |
| Security hardening baseline | Training records |
| Backup/restore proof templates | RP release decision |

Blank templates ≠ completed validation.

---

## 6. Updated permission matrix (target enforcement)

| Module example | view | create | edit | submit | approve | release | sign | void | export | override | administer |
|----------------|:----:|:------:|:----:|:------:|:-------:|:-------:|:----:|:----:|:------:|:--------:|:----------:|
| dispatches | ✓ | ✓ | ✓ | ✓ | | ✓ | ✓ | ✓ | ✓ | | |
| goods_receivings | ✓ | ✓ | ✓ | ✓ | ✓ | | ✓ | ✓ | ✓ | | |
| capas | ✓ | ✓ | ✓ | ✓ | ✓ | | ✓ | ✓ | ✓ | | |
| stock_batches | ✓ | ✓ | ✓ | | | | | ✓ | ✓ | | |
| reports | ✓ | | | | | | | | ✓ | | |
| trade / partners | ✓ | ✓ | ✓ | | ✓ | | ✓ | | ✓ | ✓ | |
| system | | | | | | | | | | | Admin |

**Rules:** Admin administer ≠ RP release/sign. Override requires RP/Deputy or valid signed delegate + MFA.

---

## 7. ER / data impacts (incremental)

New/expanded concepts (not full redraw of existing schema):

- `installations` / `release_records`
- `organisation_settings` (branding, WDA, locale)
- `evidence_attachments` expanded metadata + `predecessor_id`
- `trade_partner_conditions` structured fields
- Stock ledger remains central fact table for movements; controlled batch status only via ledger/state service
- `authority_delegations.approval_signature_id` enforced FK to signatures

---

## 8. Clean commercial backlog (ordered)

1. P1.0 Release identity  
2. P1.1 Extended RBAC runtime  
3. P1.2 E-sign TX bind everywhere critical  
4. P1.3 Universal ledger  
5. P1.4 Dispatch duplicate batch  
6. P1.5 Evidence ACL  
7. P1.6 Evidence versions + metadata  
8. P1.7 Migration/installer harden  
9. P1.10 Delegation e-sign  
10. P1.11 Trade Gate conditions / no DDL  
11. P1.9 Backup+evidence restore proof  
12. P1.12 Concurrency suite  
13. P1.8 Signed package freeze  
14. P2.1 Org config / debrand  
15. P2.3 Environment modes  
16. P2.4–P2.5 Module register + legacy cleanup  
17. P2.6 Role dashboards  
18. P2.2 Onboarding wizard  
19. P3.* Ops/support/export/docs/legal drafts  
20. P4 Pilot  

**Explicitly out of backlog until post-pilot:** shared multi-tenant SaaS, AI Report Writer commercialisation, accounting live connectors, unfinished cold-chain APIs, advanced analytics.

---

## 9. Cross-cutting risks and limitations

| Risk | Limitation / mitigation |
|------|-------------------------|
| Overstating readiness | Keep “Controlled Validation Candidate”; no MHRA language |
| Role breakages when enforcing actions | Role template refresh + UAT |
| Storage growth from evidence versions | Retention + archive tiers |
| Ops load of single-tenant | Accept higher cost for first 3 customers vs SaaS risk |
| Legal unreadiness | Block wider sale until solicitor pack |
| RP dependency | Product assists; does not replace RP judgement |

---

## 10. Immediate next action

**Start Phase 1.1 only:** enforce extended permissions on regulated controller/service gates; update tests; do not add modules.

When you confirm, implementation proceeds in the sequence above.

---

## Document control

| Field | Value |
|-------|-------|
| Title | Commercial Pilot Directive Response |
| Relates to | User Final Developer Directive (19 Jul 2026) |
| Companion | Canvas `commercial-pilot-directive-plan.canvas.tsx` |
| Also copied to | `mvc/docs/COMMERCIAL_PILOT_DIRECTIVE_PLAN.md` (if present) |
| Status | Planning baseline — not a claim of Pilot readiness |
