docs(prd): sandbox-vs-prod posture + certified-accounting-grade operations

New compliance.md leaf: French bookkeeping obligations mapped to fleet
mechanisms — inaltérabilité (L.123-22) via an append-only production
ledger grammar (create/validate/pay/avoir, never mutate a validated
document) enforced by a promote-plan compliance linter; FEC (L.47 A
LPF) with quarterly export + Test Compta Demat validation (accounting-
module binding flagged as unverified gap); piste d'audit fiable (289
VII CGI) framed as a by-product of journals + tx-id reco + monthly
packs; retention, numbering, copie fiable; loi anti-fraude scoped out
(B2B-only) with BlockedLog as sandbox-first belt-and-braces.

New Environments section in agent-architecture: prod = the ledger
(grammar-bound), sandbox = disposable iso-prod rehearsal (exempt, never
wired to production third parties); side_effect_class -> environment/
credential mapping; POCs write on sandbox only; evals target fresh
checkpoints; irreversible-by-design features trial on checkpoints.

Woven through hub (goal, requirement, success criteria, leaves table),
T03/T05/T15 guardrails, QA (linter suite, pure-append snapshots, FEC
cadence, PAF evidence framing), C2, POC-1 exit criteria.

Co-Authored-By: Claude Fable 5 <[email protected]>

vibe/PRD/ai-back-office/task-inventory.md

@@ -81,7 +81,7 @@ Backlog (not yet specified): [see bottom](#backlog--deferred).
   6. [HUMAN+AGENT] Gated promote to prod (`arcodange promote apply --target prod`, env-confirmed, prod key never stored) — per [ADR 0003](../../ADR/0003-sandbox-state-lifecycle.md).
   7. [AGENT] Attach the source PDF to the prod supplier invoice in the GED (*gestion électronique de documents* — Dolibarr's attached-files store), verify by re-read + snapshot delta; journal the run.
 - **Outputs:** recorded + documented supplier invoice in prod; journal entry; GED attachment.
-- **Guardrails:** idempotency key = (supplier, `ref_supplier`, TTC) — a replay can never double-record; the sandbox host-guard structurally refuses prod; validation of the *recorded* state, not just the request.
+- **Guardrails:** idempotency key = (supplier, `ref_supplier`, TTC) — a replay can never double-record; the sandbox host-guard structurally refuses prod; validation of the *recorded* state, not just the request; once validated, the document is immutable — corrections are avoirs, per the [ledger grammar](compliance.md#the-ledger-grammar-production).
 - **Today:** all write machinery exists and is proven (`dolibarr-sandbox-write`, promote plan/apply, business-key lookup); it is driven by hand from Claude Code sessions.
 - **Target:** **A2**, Claude tier assembling/verifying, human approving via Telegram.
 
@@ -108,7 +108,7 @@ Backlog (not yet specified): [see bottom](#backlog--deferred).
   3. [AGENT] Run the mandatory-mention audit on the produced PDF (`dolibarr-invoice-audit`: SIRET, RCS, TVA intracom, L.441-10 penalties, 40 € indemnity, etc.).
   4. [HUMAN] Approves the send; [AGENT] emails the invoice to the client contact (allowlisted recipient) and records the expected due date per the contracted payment cycle.
   5. From 2027-09: [AGENT] submits the e-reporting data for this international transaction via the PA (leaning Qonto — [challenges C12](challenges.md#c12--e-invoicing-reform-unknowns)).
-- **Guardrails:** outbound email is always human-gated; the invoice number sequence is owned by Dolibarr (never fabricated); a failed mention-audit blocks the send.
+- **Guardrails:** outbound email is always human-gated; the invoice number sequence is owned by Dolibarr (never fabricated); a failed mention-audit blocks the send; a validated invoice is immutable — corrections go through an avoir + re-issue ([ledger grammar](compliance.md#the-ledger-grammar-production)).
 - **Today:** template inspection + invoice audit are A3-eligible (read, on demand); issuance is manual in the UI.
 - **Target:** **A2**; Claude tier.
 
@@ -215,8 +215,8 @@ Backlog (not yet specified): [see bottom](#backlog--deferred).
 
 ### T15 — Monthly coherence audit
 
-- **Trigger:** 1st of month (after T07 has converged).
-- **Mode opératoire:** [AGENT] compose the read skills into one audit pack: every invoice's payment state vs bank evidence, TVA bases vs invoice lines, thirdparty completeness, template health, credit-note consistency, GED attachment presence; attach the month's snapshot hash; archive the pack (git + GED) and distill a summary note into the second brain ([T17](#t17--knowledge-capture--retrieval-second-brain)); digest the exceptions only.
+- **Trigger:** 1st of month (after T07 has converged); extended scope every quarter.
+- **Mode opératoire:** [AGENT] compose the read skills into one audit pack: every invoice's payment state vs bank evidence, TVA bases vs invoice lines, thirdparty completeness, template health, credit-note consistency, GED attachment presence; attach the month's snapshot hash; archive the pack (git + GED) and distill a summary note into the second brain ([T17](#t17--knowledge-capture--retrieval-second-brain)); digest the exceptions only. **Quarterly, additionally:** export the FEC and validate it (*Test Compta Demat*), and verify ledger discipline — snapshot history shows pure appends, no validated document mutated, numbering gapless (BlockedLog chain check if adopted) — per [compliance](compliance.md#dolibarr-verifications-sandbox-first).
 - **Guardrails:** read-only; exceptions route to the owning task's queue rather than being fixed inline.
 - **Today:** each check exists as a skill; composition is manual (the ad-hoc "cohort review" audit sessions run in Claude Code today). **Target: A3**; Claude tier.