Stage 2: go deeper in seven sessions

Seven sessions of 45 to 60 minutes. Go deeper: the rules behind each door, and a drill in every session where you do the wrong thing on purpose. Your ticks save here, under your name, so you can pick up on any device.

Who is training?

Type your name to start your own path, or resume with the code you were given. One name covers both courses.

Your name

Resume: your name

Resume code

The team

Everyone's path, one row each. Both courses, side by side. Names and counts only.

Nobody has started yet. Be the first.

Session 1 · 0/30 Session 2 · 0/29 Session 3 · 0/32 Session 4 · 0/27 Session 5 · 0/25 Session 6 · 0/26 Session 7 · 0/25

Pick a name above to turn on the tick boxes. You can read everything without one.

Session 1 · The law rooms, close up0/30 steps

55 minutesLog in as pat, and as kai for the second pair of hands

Today's goal: learn the four rules that hold the money book steady: who may stamp, two hands, the close calendar, and reverse never erase.

Before you start (3 min)

This course sits beside the 7-day one. Do that one first. Here we open the same doors and look at the rules behind them.

Go to tape.rightweb.app/login. Tick Start fresh before you log in. That puts the demo shop back to the same rows the pictures were taken from. Without it, other people's work is still there and your numbers will look different.

Two words you will use all week. A draft is a suggestion nobody has agreed to. A stamp is a named person saying yes. Only a stamp moves money.

1.1 Read the approval bands10 min

The live approval band. It says which drafts it covers, who may stamp them, and how many hands are needed.

The 27 draft kinds this build can stamp. Any other kind is refused.

Log in as pat@flour.shop. In the left menu, under Law, click Policy.
Find the card Kinds this build can stamp. Count the kinds. There are 27.
Find Live approval bands. Read the row: rule approval-v1, from 2026-04-01, up to any amount, 1 stamp, nudge after 72 hours.
Read the list of roles in that band. A person whose role is not on the list cannot stamp, however senior they are.
Click the version name approval-v1. You land on the tape row that published it.

You should see: a band that covers every kind, needs one stamp, and names eight roles.

Why it matters: the band is a published rule, not code. A shop that wants two stamps over $5,000 publishes a new version. Nobody edits the old one.

1.2 Two hands on a stamp10 min

The duty pairs. Each pair is two keys one person should not hold at the same time.

Your own draft with two hands on. There is no Stamp button, only Withdraw.

Who said yes. Drafted by one person, decided by another, both on the tape.

Click Rights (Law group). Scroll to Separation of duties. Read the four pairs and the clash table below them.
Note the words Enforcement is OFF. The report still runs; nothing is refused yet.
Go to Stamp inbox. At the bottom, in the Switches card, press SoD on.
In Hand draft a journal, type "Window cleaning for September", amount 40, debit pocket 6000, credit pocket 2000. Press Save as draft.
Look at your new draft. Where the Stamp button was, it now says your draft, a second person stamps.
Open a private window. Log in as kai@flour.shop (password draft-me). Go to the stamp inbox and press Stamp on your draft.

You should see: the draft leaves pat's inbox. In Policy, under Who said yes, the row says drafted by Pat and decided by Kai.

Why it matters: one person writing and stamping the same row is how money walks out of a shop. Two hands is a rule, not a habit.

1.3 The close calendar and the close pack12 min

The close checklist. Each step has an owner role and a day it is due.

Two names on the close: one prepared, a different one reviewed.

One extra key for one person, with an end date if you are lending it.

As pat, click Close (Money group). Read the Close checklist. Five steps, each with an owner role and a due day.
Press Tick on every step. Each tick is its own row on the tape with your name on it.
In Close pack, two names, press Prepare September 2026. Your name and the time appear, with a pin.
Go to Rights. In Grant a key, pick Kai the clerk and the key period.lock. Press Grant a key.
In kai's window, go to Close. Type "I checked the bank and the bills" and press Review September 2026.

You should see: two different names on the close pack, each with its own tape row.

Why it matters: the close pack is what you hand the accountant. It is built from the tape when you ask for it, so it can never drift from the facts.

1.4 Drill: review your own work6 minrefusal drill

Do the wrong thing on purpose. Read the refusal, and write down the words it used.

The refusal names the pair: close-prepare-vs-review.

Do this before step 1.3-5, or on a fresh month. As pat, after pressing Prepare, type any reason in the review box.
Press Review September 2026 as the same person who prepared it.
Read the red line under the button. Write down the pair name it gives you.
Check the tape. Nothing was written. A refusal leaves no row.

You should see: "The person who prepared the close cannot review it. Two names on a close, always. (close-prepare-vs-review)"

Why it matters: the refusal names the rule it comes from. You never have to guess why a door said no.

1.5 Drill: lock a month out of turn6 minrefusal drill

Do the wrong thing on purpose. Read the refusal, and write down the words it used.

September will not lock while July is still open.

On the Close page, read the grey line: Months lock in order. Lock July 2026 first; it is the oldest open month.
Press Lock September 2026 anyway.
Read the red line. It names the month you must lock first.
Note what it did not do: it did not quietly lock July for you.

You should see: "Lock 2026-07 first. Months lock oldest first, in order."

Why it matters: a book that can be locked out of turn has holes in the middle. The rule is boring on purpose.

1.6 Reverse, never erase, and the chain10 min

The batch list. The old row keeps its amount and a new row sits beside it.

A pocket code that is already on the chart is refused.

The month replayed from the tape alone, pocket by pocket, against the print.

The tape, with the green banner: the hash chain holds.

Click Ledger. Find batch JE-000009 in the Journals table.
Type "The loaf count was wrong" in its reason box and press Reverse.
Look at the table again. JE-000009 still shows its old amount. A new batch sits above it.
Drill: in Open a pocket, type code 1000, name "Bank again", type asset. Press Open a pocket. Read the refusal.
Scroll to Rebuild from tape. It replays the month from the gl.posted rows alone and compares it to the print.
Click The tape. Read the green banner: Hash chain holds, with the row count.

You should see: "Pocket 1000 already exists. Retire it or pick another code." and "Every pocket matches."

Why it matters: an erase hides a mistake. A reversal shows the mistake and the fix, both for ever. That is what an auditor is looking for.

Check yourself

Who decides whether you may stamp a $9,000 bill?

The published approval band live on that day. It names the kinds, the amount ceiling, the roles and how many stamps are needed.

Two hands is on. You drafted a journal. What does the inbox show you?

Your own draft with no Stamp button, and the words "your draft, a second person stamps". You can withdraw it, not stamp it.

The close pack needs two names. Who can be the second one?

Anyone holding the period.lock key who did not prepare it. In the demo you grant that key to Kai first.

Why will September not lock while July is open?

Months lock oldest first, in order. A book with a locked month after an open one has a hole in the middle.

You reversed a journal. What happened to the first row?

Nothing. It keeps its amount for ever. A new, opposite row sits beside it.

What does "Rebuild from tape" prove?

That the month's print can be made again from the tape rows alone, pocket by pocket. If a pocket differed it would show red.

Session 2 · Money in and money out, end to end0/29 steps

60 minutesLog in as pat

Today's goal: take one sale from order to invoice to dispute to credit, hold a supplier bill, try to pay it anyway, and prove the cash.

The shape of this session (3 min)

Money in lives in Receivables. Money out lives in Payables. The bank sits between them in Bank, and Tax reads what both of them did.

Watch for one habit all session: nothing here types a date or a pocket by hand. The due date comes from a published terms rule. The pockets come from a published coding rule. A missing rule refuses.

2.1 An order becomes an invoice10 min

Open receivables. The due date came from the published payment terms.

Ageing. Worked out when you look. No bucket total is stored.

Click Receivables. Read the four cards at the top: open receivables, orders to invoice, late, in dispute.
In Invoice an order, leave the Harbour Cafe order picked and press Turn an order into an invoice.
Look at Open receivables. The invoice is there with a due date you never typed.
Read the Ageing table. Four buckets. The note says nothing here is stored.
Click the amount. You land on the tape row for the invoice.

You should see: one open item for Harbour Cafe, sitting in the "current" bucket.

Why it matters: the due date comes from the rule NZ-20TH-v1. Change the rule and every new invoice changes. Old ones keep the date they were given.

2.2 A dispute, then a credit note12 min

The dispute opened a hole with an owner and an age.

After the credit note the open amount is smaller. The first invoice row is unchanged.

In The customer says this bill is wrong, pick the invoice, type amount in doubt 150 and "They say two trays never came". Press Raise a dispute.
Click Holes in the left menu. Your dispute is there, with your name as owner and an age in days.
Go back to Receivables. The In dispute card now shows 1. No money moved.
In Write a credit note, pick the invoice, amount 150, reason "Two trays came back". Press Write a credit note.
Look at open receivables. The open amount fell. Click through to the invoice row: it still shows the first amount.

You should see: the invoice open amount drops by the credit, and the original invoice row is untouched.

Why it matters: a dispute is a fact, not a number change. It makes the open list stop looking healthy so somebody chases it.

2.3 Drill: the same supplier bill twice6 minrefusal drill

Do the wrong thing on purpose. Read the refusal, and write down the words it used.

The second bill with the same reference and date is refused by name.

Click Payables. In Stamp a supplier bill, supplier Mill & Co, ref MILL-2001, net 120. Leave the lines box empty. Press Stamp a supplier bill.
Do it again with exactly the same reference and the same day.
Read the red line. It names the reference and the date.
Look at Open payables. There is one MILL-2001, not two.

You should see: "Bill MILL-2001 dated 2026-09-15 already exists for this supplier."

Why it matters: paying the same bill twice is the most common way a shop loses money. The key is supplier plus tidied reference plus invoice date, so "MILL 2001" cannot slip past "MILL-2001".

2.4 Drill: pay a bill that is on hold10 minrefusal drill

Do the wrong thing on purpose. Read the refusal, and write down the words it used.

The held bill. It stays in the ageing print, marked, never hidden.

The inbox says the stamp would refuse before you press it, and says so again when you do.

In Hold a bill, pick MILL-1044, reason "The price is not what we agreed", note "waiting on the mill". Press Hold a bill.
Look at Aged payables. The held bill is still there, marked. Nothing is hidden.
In Draft a payment run, put the held bill in the bills box and press Draft a payment run. It drafts fine.
Go to Stamp inbox. Find the pay_run draft. Read the red banner under it before you touch anything.
Press Stamp. Read the refusal. Write down who owns the hold.

You should see: "Bill MILL-1044 is held: price_wrong (The price is not what we agreed), owned by user-pat. Release the hold before paying it."

Why it matters: the draft is cheap and the stamp is the gate. The inbox even tells you the stamp would refuse before you press, so nobody wastes a trip.

2.5 Two hands on bank details8 min

A change to a supplier's bank details waits for a second named person.

In Change a supplier's bank details, last four digits 6789, where it came from "letter on the supplier's paper". Press the button.
Read the banner at the top of the room: Payees waiting on a check.
Look at Check bank details. The change is waiting there for a second person.
Click through to the tape row for the change. Only the last four digits are on it.

You should see: the supplier named in the "waiting on a check" banner, and a masked account like •••6789 on the row.

Why it matters: the most expensive fraud is a changed bank number on a real supplier. Two people and a masked number is the cheap defence.

2.6 Prove the cash, then drop the feed12 min

Proof of cash. Every cent of the gap between the bank and the book is named.

Feed down. The banner is loud and new lines are refused.

Tax this month, added up from the tape when you open the page.

The bank line after the match. Nothing was edited; a new row settled it.

Click Bank. Read Proof of cash: what the bank says, what the book says, and the gap.
Read the rows under the gap. Every one has a reason: not matched yet, or in the book but not on the statement.
In Match a bank line to an open item, press Match. The line stops being open.
In Undo a match, pick the matched line, reason "Matched the wrong bill", press Undo. Nothing is erased: the journal is reversed.
Press Feed down at the top of the room. Read the red banner. Press Feed up to put it back.
Click Tax. Read Tax this month. Click a number to reach the row behind it.

You should see: "Feed DOWN. New lines are refused until it is fixed." and a tax table where each amount is a link.

Why it matters: a bank feed that dies quietly is worse than one that dies loudly. A red banner is a feature.

Check yourself

Where does an invoice due date come from?

The published payment terms rule live on the invoice date. Nobody types it.

A customer says a bill is wrong. What should you do first?

Raise a dispute. It moves no money, opens a hole with your name on it, and stops the open list looking healthy.

Does a credit note change the invoice?

No. The invoice keeps its amount for ever. The credit note is a new row pointing at it, and the open amount is worked out from both.

Why was the second MILL-2001 bill refused?

The key is supplier plus tidied reference plus invoice date. The same three means the same bill.

You can draft a payment run for a held bill. Why?

A draft is only a suggestion. The check runs at the stamp, and the inbox warns you before you press.

What is proof of cash?

The bank balance against the book balance, with every cent of the difference named by a reason and a row.

Session 3 · Sell it, buy it, make it, ring it0/32 steps

60 minutesLog in as pat

Today's goal: walk one sale from a quote to a shipped parcel, raise a purchase order, count a shelf, and ring the till with two kinds of money.

Four different facts (3 min)

A quote is a price that is good until a day. An order is a promise to buy. A shipment is goods leaving. An invoice is a demand for money. They are four facts, not four names for one.

Every one of them is a separate row on the tape, and only the last one moves money.

3.1 Quote, order, ship, invoice14 min

Quotes. Live or run out is worked out when you look, from the good-until day.

The order board. Every id and amount is a door to the fact that made it.

Shipping drafted the invoice. It waits in the stamp inbox for a named person.

Click Orders. In Quote, pick Harbour Cafe, item Sourdough loaf, qty 30, price each 8.00, good until 2026-10-15, basis List price. Press Quote.
Read the Quotes table. The price check column says every line is the list price.
In Place order, pick Harbour Cafe, amount 240, and press Place order.
Read the Order board. Ordered but not invoiced, and a gap column. Click an amount to reach its row.
In Ship it, pick an order and a carrier, and press Ship it.
Go to Stamp inbox. The invoice is waiting there as a draft. Shipping never moved money.

You should see: an invoice draft in the inbox that you did not write, with the order behind it.

Why it matters: the floor should never be able to post money. It writes a fact, the fact drafts the money, and a named person in the money room stamps it.

3.2 Drill: hold more stock than there is8 minrefusal drill

Do the wrong thing on purpose. Read the refusal, and write down the words it used.

Free to promise is worked out when you ask. A hold over it is refused, never guessed.

On hand, held, and free. The free number is never stored on the item.

Still in Orders, scroll to Hold stock. Pick Strong flour, bin Bin A flour, qty 9999, any end day. Press Hold stock.
Read the red line. It tells you how many are free and how many you asked for.
Do it again with qty 10. It works.
Read Free to promise. On hand did not change. Held went up and free went down.
Note the end day on the hold. A hold with no end day would lock stock for ever.

You should see: "46 free, 9999 asked. Refused, not guessed."

Why it matters: free to promise is a question, not a stored number. Storing it is how two salespeople sell the same bag.

3.3 Buy: an order, a receipt, and goods with no order10 min

Purchase orders, with what is still to come and how many days it has been open.

Goods that turned up with no order. They land, because they are real, and each gets a ticket somebody owns.

Click Buy. In Raise a purchase order, pick Mill & Co, Strong flour, qty 6, unit 18. Leave the approval box blank. Press the button.
Read the Purchase orders table. Ordered, received, still to come, days open.
Use Take some in on your new order: qty 4 into Bin A flour. Part loads are normal.
Read Arrived with no order. Two rows from the seed, each with a ticket id.
Click one ticket id. It opens the hole, with an owner and an age.

You should see: an order with 4 received and 2 still to come, and two amber tickets for the goods nobody ordered.

Why it matters: goods that turn up with no order are real, so they are written down. Refusing them would mean the shelf and the book disagree.

3.4 Drill: pick more than the bin holds, then count it10 minrefusal drill

Do the wrong thing on purpose. Read the refusal, and write down the words it used.

A short pick refuses and nothing moves. The short itself is still written down.

A count is a photo. The bin only moves when a second named person stamps the difference.

Click Warehouse. In Pick, pick Sourdough loaf from Front counter, qty 9999, any order ref. Press Pick.
Read the red line. It tells you what is really on hand.
Scroll to Shorts to chase. The short was written down even though the pick refused.
In Count, pick Sourdough loaf, Front counter, counted qty 16. Press Count.
Click Stock. Read Open count differences. The bin has not moved yet.

You should see: "Short pick. On hand 18." and a count difference waiting for a second person.

Why it matters: two things happen at once and they are kept apart: the move is refused, and the fact that stock was missing is kept. A refusal must never lose information.

3.5 The till: two tenders, a shut drawer, a dead card reader14 min

A sale at a closed till is refused by name.

With the card network down, a card tender is refused and cash still rings.

The Z-tape. Every line is worked out from the tape, not stored.

The shop day, built from the tape every time. Money taken by kind.

Click Till. In Ring a sale, pick the Side counter (it is closed), one loaf, cash 9.20. Press Ring a sale. Read the refusal.
Now pick Front counter, qty 2, cash 10, card 8.40, and ring it. Two kinds of money on one sale.
Read Shop day. Money taken by kind, worked out from the tape.
In the Front counter card, type "the reader stopped talking" and press Card network is down.
Ring another sale at Front counter with only a card tender. Read the refusal.
Read the Z-tape on the till card: opening float, cash taken, card taken, and the cash the tape expects in the drawer.

You should see: "Till Side counter is closed. Open the till before ringing a sale." and "The card network is down at Front counter. Cash only until it is back."

Why it matters: a till that keeps taking card money while the reader is dead makes a number nobody can settle. Saying no is the cheaper answer.

3.6 Make: a recipe is a version8 minrefusal drill

Do the wrong thing on purpose. Read the refusal, and write down the words it used.

A recipe is a published rule with a version. An old job keeps the recipe that made it.

Work orders, with what they cost and their yield, worked out from the rows.

The same recipe version twice is refused. Publish the next version instead.

Click Make. Read Bills of materials: one recipe, version 1, what it makes and what it is made from.
In Open a work order, pick the recipe and say how many, then press Open a work order.
Read the Work orders table: what it cost and its yield, both worked out from the rows.
Find Send cost to the stamp inbox on a finished job. The floor drafts the money; it never posts it.
Drill: in Publish a recipe, put version 1 for the loaf again and press the button. Read the refusal.

You should see: "Recipe version 1 for item-loaf is already published. Publish the next version instead."

Why it matters: a job that already ran keeps the recipe that made it. If a version could be changed, last month's cost could never be explained.

Check yourself

A quote, an order, a shipment and an invoice. Which one moves money?

Only the invoice, and only once a named person stamps the draft it made.

Why is "free to promise" never stored on the item?

Because it is on hand minus every live hold, worked out when you ask. A stored copy goes stale and two people sell the same stock.

Goods arrive with no purchase order. What happens?

They land on the tape, because they are real, and a ticket is opened with an owner so somebody sorts it before a bill turns up.

A pick is refused for a short. What is kept?

The short itself. Nothing moves, but the fact that stock was missing is written down so it cannot be lost with the refusal.

Is a stock count a change to the bin?

No. A count is a photo. The difference becomes a draft, and the bin only moves when a second named person stamps it.

The card reader dies. What still works at the till?

Cash. A card tender is refused by name until somebody says the network is back. Nothing flips itself.

Session 4 · People, pay and plant0/27 steps

55 minutesLog in as nia for people, pip for pay, pat for plant

Today's goal: hire someone with a real pay profile, book hours and leave, claim spend, run a pay week, and charge wear on an oven.

Nothing is guessed (3 min)

Pay is where a guess costs the most. So the shop guesses nothing: there is no default hourly rate, no default tax code, no default retirement rate. If you do not give one, the hire is refused.

Pay weeks are their own calendar. A pay week is not a month, and a pay run lands in the month its pay day falls in.

4.1 Hire someone, with the pay profile on the row12 min

People ops. Class, tax code, retirement share and rate all ride the hire row.

One email is one person. The second hire is refused by name.

Log in as nia@flour.shop (password hire-well). Click Org.
In Hire: name Alex Baker, email alex@flour.shop, unit Bakehouse, job Baker, start day 2026-09-01, kind full time.
Fill the pay half: hourly 28.00, tax code M, retirement share 3, bank last four 4321. Press Hire.
Click Hire in the left menu (People group). Alex is in the table with every field you typed.
Drill: go back to Org and hire again with the same email. Read the refusal.
Read the note under Who may not stamp pay. People ops and pay are two hands.

You should see: "alex@flour.shop is already a person here. Reuse that row or use a different address."

Why it matters: one email is one person. Two rows for one person is how a shop pays somebody twice and cannot prove who is who.

4.2 Drill: ask for leave you have not earned10 minrefusal drill

Do the wrong thing on purpose. Read the refusal, and write down the words it used.

The balance is a print. Going under zero needs a named person to say why.

Leave is a draft kind with no money. A manager stamps it.

Click Time. Read the Leave balance card and the rule name under it.
In Clock hours, pick Jess Baker, hours 8, press Clock hours.
In Ask for leave, pick Jess, kind Annual, hours 40, first and last day next month. Press Ask for leave.
Read the refusal. It gives the balance and the ask, both.
Ask again for 1 hour. It drafts. Leave is a draft kind that moves no money.

You should see: "party-jess has 1.92 hours of leave and asked for 40. Refused unless a named person says why."

Why it matters: the balance is worked out from the rule and the rows each time. It is never a stored number that quietly drifts.

4.3 Drill: claim spend with no receipt8 minrefusal drill

Do the wrong thing on purpose. Read the refusal, and write down the words it used.

The spend rule names the amount a receipt starts being required.

In Submit spend, spend day 2026-09-10, shop "Fuel stop", amount 80, category Travel, receipt No receipt. Press Submit spend.
Read the refusal. Write down the rule name and the cents figure in it.
Claim 24 instead, with a memo. It drafts and waits in the stamp inbox.
Read the line under the card: a second person stamps it, and only then does money move.

You should see: "Travel needs a receipt at 5000 cents or more, by spend rule spend-v1. Store the receipt first. Nothing was written."

Why it matters: the rule is published and dated, so what counted as "needs a receipt" last March is still readable today.

4.4 Run a pay week14 min

Check before any money moves. It runs the same working the stamp runs and writes nothing.

A week nobody worked is refused, not paid as zero.

The pay week after the stamp, with its own filing state.

Log in as pip@flour.shop (password pay-right). Click Pay.
Read the red warning at the top. The demo pays from a demo pack, not from the law.
Read Check pay-2026-w34 before any money moves: gross, tax, retirement, net, and the two rule hashes used.
On the pay-2026-w34 row press Close timesheets, then press Stamp pay run.
Click Ledger. The pay run is a batch in the money book with five lines.
Drill: go back to Pay and press Stamp pay run on pay-2026-w35, a week nobody clocked. Read the refusal.

You should see: "No timesheets are on the tape for pay-2026-w35. Nothing to pay, the period stays open."

Why it matters: a pay run with nobody in it is a mistake, not a zero. Paying zero quietly would hide a week of lost timesheets.

4.5 Plant: wear as a draft, then sell the oven10 min

The wear run works the whole month out and drafts it. Nothing posts on a timer.

The wear run waiting in the stamp inbox for a named person.

The plant register after the sale. Nothing is erased.

Log in as pat. Click Plant. Read the amber line: one asset got no wear charge this month.
Read Wear run for September 2026: what it would charge, and for each asset why or why not.
Press Run September 2026. Go to the stamp inbox and find the draft.
Back in Plant, read the Tax book table. The same buys, read a second time through the tax rule. It writes no rows.
In Sell plant, pick OVEN-1, sold, money in 9000, into pocket 1000. Press Sell plant.
Read the register. The asset is off the books and its cost is still there.

You should see: a wear run waiting for a stamp, and a tax book whose numbers differ from the book on purpose.

Why it matters: two sets of numbers that are both read from the same rows can never drift apart. Two stored sets always do.

Check yourself

Why is there no default hourly rate?

Because a default would be a guess about somebody's pay. The hire is refused until a person types the rate.

Is a pay week the same as a month?

No. Pay periods are their own calendar. A run lands in the month its pay day falls in.

What does the leave balance come from?

The published award rule and the rows: accrued minus taken. It is a print, never a stored number.

You claim $80 of fuel with no receipt. Why refused?

The published spend rule says Travel needs a receipt at 5000 cents or more. Nothing was written.

The wear run is a draft. Why not post it straight away?

Nothing posts on a timer. A named person stamps the month's wear, so there is always a person behind the number.

What is the tax book?

The same asset buys read again through the tax rule. It is a print: it writes no row and no money line, so the two sets can never drift.

Session 5 · The way in0/25 steps

50 minutesLog in as pat

Today's goal: bring a spreadsheet in without letting the shop guess anything, read a connector refusing by name, and find the door that has no button yet.

One rule for every way in (3 min)

A file, a paper list, a connector: all of them only draft. A named person stamps every row. Nothing arrives already true.

And nothing is guessed. If the shop does not know what a column means, it refuses the whole file and names the column.

5.1 Drill: a file with no column map10 minrefusal drill

Do the wrong thing on purpose. Read the refusal, and write down the words it used.

No map, no import. The refusal names the policy kind you have to publish.

Name each column, or mark it ignore, then publish the map.

Click Way in. Leave the shape on parties.
Paste this into the CSV box:
party_id,legal_name,email
party-oak,Oak Street Deli,hi@oak.nz
party-quay,Quayside Cafe,hi@quay.nz
Press Preview. Read the refusal. It names the policy kind and every column in your file.
A Name each column card appears. Set party_id to party_id, legal_name to legal_name, email to email.
Type map version parties-v1 and press Publish the map.

You should see: "No column map for parties. Publish a policy of kind import_map_parties... The importer never guesses which column is which."

Why it matters: a guess about which column is the email is a guess about who a customer is. The map is a published, dated rule like every other rule here.

5.2 Preview, then draft, then stamp12 min

Preview writes nothing. It says how many rows would draft, how many refuse, and which map it used.

Drafted. Nothing is on file until a named person stamps each row.

The imported rows waiting in the stamp inbox.

Paste the same two rows again and press Preview. Read the line: rows, would draft, refused, flagged, map version, and the room it lands in.
Press Draft every row. Read the green banner about the stamp inbox.
Go to Stamp inbox. Your two parties are there as drafts, not as parties.
Stamp one of them. Then click People book. Only the stamped one is in the party table.
Go back to Way in and read Files brought in. The batch row carries the file hash.

You should see: two drafts in the inbox, and only the one you stamped in the party table.

Why it matters: an import that writes straight into the shop is an import nobody checked. Drafts make the check the normal path, not the careful path.

5.3 Drill: the same file twice, and a column nobody named10 minrefusal drill

Do the wrong thing on purpose. Read the refusal, and write down the words it used.

The same file again. Drafted 0, skipped 2. Nothing new was written.

One column with no rule refuses the whole file and names the column.

Press Draft every row with the same two rows again.
Read the result line: drafted 0, skipped 2, already drafted from this same file.
Now paste a file with a new column:
party_id,legal_name,loyalty_points
party-pier,Pier Bakery,220
Press Preview. Read the refusal and write down the column it names.
Note that one bad column refused the whole file. Nothing half landed.

You should see: "Column "loyalty_points" has no rule in the import_map_parties map. Name it (a field, or "ignore") and publish the map again."

Why it matters: half an import is worse than none: you cannot tell which half is real. The file hash is the key that makes a second run safe.

5.4 A connector that refuses by name10 min

The Xero preview with no keys set. It says which settings are missing and that nothing was read.

Country packs. Rates live on versioned rules, and a missing pack refuses the bill.

While you are logged in, open https://tape.rightweb.app/api/v1/connectors/xero/preview?shape=contacts in a new tab.
Read the answer. It names the three settings the owner has to set, and says nothing was read and nothing drafted.
Change shape=contacts to shape=nonsense. A different refusal lists the shapes it knows.
Click Tax in the left menu. Read Country packs: one version, from a day, with a hash.
Note the words on that card: a missing pack refuses the bill, it never guesses.

You should see: "This shop is not joined up to Xero yet. Set XERO_CLIENT_ID, XERO_CLIENT_SECRET, XERO_TENANT_ID..."

Why it matters: a connector with no keys could have answered an empty, healthy-looking plan. Instead it says what is missing. Degrade loudly.

5.5 Undo a move, and the doors with no button8 min

undo-import on the door list. It is a real door with no screen button yet.

Click API & MCP (Law group). Find the op table headed Act ops.
Find undo-import. That door takes back one whole batch: it rejects the drafts, reverses the money, and retires what it made.
Look for a button for it on the Way in page. There is none yet. It is a door for a script, not a screen.
Read import-sheet and publish-policy in the same table. Every screen you used today goes through one of these.
Note the sentence above the table: a value with no zone is read as UTC, and nothing defaults to a demo id.

You should see: undo-import listed as a door, with no screen for it.

Why it matters: screens and scripts are two doors into the same brain. When a door has no button yet, the honest answer is to say so, not to pretend the job cannot be done.

Check yourself

What happens to a file whose columns have no map?

It is refused whole, and the refusal names the policy kind to publish and lists the columns it found.

An import ran. Is the data in the shop?

No. It made drafts. A named person stamps each row in the stamp inbox, and only then is anything on file.

You run the same file twice. What happens?

Nothing new. The file hash is the key: drafted 0, skipped 2.

One column in a hundred has no rule. How much lands?

None of it. Half an import is worse than none, because you cannot tell which half is real.

A connector has no keys. What does it answer?

A refusal naming the exact settings that are missing, and it says nothing was read and nothing drafted.

Is undo-import a screen button?

Not yet. It is a door on the act list that a script can call. The course says so rather than pretending.

Session 6 · The shape of this shop0/26 steps

50 minutesLog in as pat, and as the Mill portal at the end

Today's goal: learn how one build serves many shops: 24 rooms, 87 switches, published rules, and what an outsider can see.

One build, many shapes (3 min)

Every shop runs the same code. What makes two shops different is what is switched on.

A room is the big switch. Under it sit the small ones: 87 feature switches, each covering one behaviour. A switch that is off refuses its doors inside the kernel. It never just hides a button and leaves the door open.

6.1 Read the shape10 min

Shape of this shop. Rooms on, switches on, switches held on by law, and the rule version in force.

One switch: what it lets the shop do, the doors it guards, and who last moved it.

Click Shape of this shop (Law group). Read the four cards: rooms on, switches on, held on by law, rule version.
Find a switch held on by law. Read the sentence under it. It says which house law keeps it on.
Pick any switch and read its grey line: the exact doors it guards, by name.
Read the last line of a switch you have not touched: Never moved in this shop.
Read the blue banner. With no switch set published yet, every switch sits at its default, which is on.

You should see: 24 of 24 rooms on, 87 of 87 switches on, 5 held on by law.

Why it matters: this page answers the question a support call always starts with: what is turned on in this shop, and who turned it that way.

6.2 Drill: flip a switch, then use the door12 minrefusal drill

Do the wrong thing on purpose. Read the refusal, and write down the words it used.

The switch is off, with the reason and the person who moved it.

The door refuses and names the switch, its key, and the room it lives in.

The flip as a tape row: sys.feature_set.

On Shape, find room 06 and the switch crm.notes.
Type the reason "This client keeps its notes somewhere else" and press Turn off.
Read the switch's last line now: who moved it, when, and the reason, with a door to the row.
Click People book. The Add a note card is still on screen. Fill it in and press Note.
Read the refusal. It names the switch, its key, the room, and where to turn it back on.
Go to The tape and filter the type by sys.. Your flip is a row. Then go back to Shape and turn crm.notes on again, with a reason. That is a second row; the first one stays, so the shop remembers it was ever off.

You should see: ""Notes, calls and visits against a party" is off in this shop. Switch crm.notes, room 06 People and CRM."

Why it matters: a hidden button is not a rule. The guard is in the kernel, so the screen, the script and the helper all get the same no.

6.3 Drill: turn a whole room off8 minrefusal drill

Do the wrong thing on purpose. Read the refusal, and write down the words it used.

A room that is off. The tape stays and the screen hides.

The room's own page when the room is off.

Click Rooms on/off. Find room 19, Plan and budget. Press Turn off and say yes to the question.
Look at the left menu. The Plan link is gone.
Type /rooms/planning in the address bar anyway. Read what the page says.
Read the card for room 19: the tape row count did not change. Nothing was deleted.
Turn it back on. Both flips are rows on the tape.

You should see: the room's page saying the room is off, with its rows still counted on the rooms page.

Why it matters: off means the door refuses, not that the history is gone. A shop can turn a room back on and its old rows are all still there.

6.4 Drill: publish a rule version that already exists10 minrefusal drill

Do the wrong thing on purpose. Read the refusal, and write down the words it used.

A rule version is published once. The second try is refused.

Published rules. Each version says when it applies and what it replaced.

Click Policy. Scroll to Publish a rule.
Kind approval, version approval-v1, applies from 2026-10-01, and any rules JSON. Press Publish a rule.
Read the refusal.
Change the version to approval-v2 and publish it. Read the Replaces column in the table.
Click the version name to reach the tape row that published it.

You should see: "approval approval-v1 is already published. A rule version is published once."

Why it matters: if a version could be republished with different words, no old stamp could be explained. A change is always a new version.

6.5 What an outsider can see10 min

What Mill and Co would see, from the staff side.

The same shop through the portal login. Same event ids, one party only.

Click Portal. Read What Mill & Co would see: the same event ids staff see, filtered to one party.
Read Give or take away a portal key. A key is for one person and one party, and taking it back needs a reason.
In a private window, log in as bills@mill.example (password portal-totp).
Compare the two lists. Same ids. No left menu. No other party's rows.
Try typing /tape in the portal window's address bar. You do not get the whole tape.

You should see: the same event ids on both sides, and nothing belonging to another customer on the portal side.

Why it matters: showing an outsider the same id staff see is what makes a question answerable. Showing them anything else is a leak.

Check yourself

What is the difference between a room and a feature switch?

A room is the big switch for a whole area. A feature switch is one behaviour under it. A room that is off speaks first.

A switch is off. What happens to its button?

The button may still be there, and the door refuses inside the kernel with FEATURE_OFF, naming the switch, its key and its room.

How many switches are held on by law?

Five. Each one names the house law that keeps it on, like reverse never erase, or the one money stamp.

Is a flip a rule or a setting?

A published rule. One flip is one set-feature op and one sys.feature_set tape row, so it is versioned, hashed and stamped.

You turn a room off. What happens to its old rows?

Nothing. The tape is never deleted. The screen hides and new facts for that room are refused.

Why can a rule version never be published twice?

Because an old stamp says which version it used. If the words behind a version could change, no old stamp could be explained.

Session 7 · Run the shop as the owner0/25 steps

50 minutesLog in as pat

Today's goal: learn the owner's jobs: watch the health door, work the holes, export the truth, pause the shop, and understand what a promotion is.

The owner's four questions (3 min)

Is it up? Is the chain whole? What is broken and who owns it? Can I get my data out?

Every one of those has an answer you can look at today. This session is the round you do on a Monday morning.

7.1 The health door and the holes12 min

The health door, read as a named person.

Holes. Each has a type, an owner, an age, and a door to the row behind it.

While logged in, open https://tape.rightweb.app/api/v1/health in a new tab.
Read the answer. As a named person you get the deep report: tape rows, open holes, open red holes, and the chain.
Open the same link in a private window, not logged in. You get much less. That is on purpose.
Click Holes. Read the four cards: open, red, oldest open, resolved.
Open one hole. It has a type, an owner, the day it opened, an age, and a link to the row it came from.
Remember from session 1: a red hole blocks the month lock. An amber one does not.

You should see: a health answer with a chain result, and a hole list where every row has a person's name on it.

Why it matters: "someone will look at it" is not an owner. Every hole has a name and an age, so nothing quietly rots.

7.2 Drill: delete the shop6 minrefusal drill

Do the wrong thing on purpose. Read the refusal, and write down the words it used.

Click Rights. Scroll to The shop's life.
Read the paragraph. There is no delete: export first, then pause or close.
Press Delete this shop anyway.
Read the refusal. It names the three doors you should use instead.

You should see: "There is no "delete-shop". A shop is never deleted: export first (export-shop), then pause it (pause-shop) or close it (close-shop). Every row stays."

Why it matters: a delete button is a single click between a business and its history. This shop does not have one, and says so rather than hiding it.

7.3 Drill: close a shop with months still open8 minrefusal drill

Do the wrong thing on purpose. Read the refusal, and write down the words it used.

Close refuses and names how many months are still open.

Still in The shop's life, type "We are shutting the bakery" and press Close this shop. Say yes to the question.
Read the refusal. Count the months it names.
Think about the order: to close, lock every month. To lock, sign the close pack with two names. To sign, tick the checklist.
Press Export my shop instead. A file downloads with a manifest: row counts and the last chain hash.

You should see: "Close refused: 4 months are still open (2026-07, 2026-08, 2026-09, ...). Lock every month first."

Why it matters: a closed shop can never write again. Closing one with open months would freeze a half-finished book for ever.

7.4 Pause the shop, and put it back10 min

Paused. Every row is kept and nothing new is written.

The stamp inbox while the shop is paused. The controls are dead, not hidden.

Live again, with both flips on the tape below.

Type "Training session, nobody should write" and press Pause this shop. Say yes.
Read the state line: paused. Read the words beside it: every row is kept, reads and the export still work.
Go to Stamp inbox. Try to draft a journal. The boxes are dead.
Go back to Rights and press Resume this shop with a reason.
Read the little list under the state. Both the pause and the resume are rows, each with its reason.

You should see: a paused shop where reading still works, and two rows on the tape saying who paused and who resumed.

Why it matters: pause is the honest answer to "stop everything now". It keeps every row and needs a named person and a reason to undo.

7.5 A fresh start, and what a promotion is12 min

The login page. Start fresh puts the demo shop back before you log in.

The four numbers that describe a shop's shape.

The three doors: a screen, a script, and a helper. All named, all checked.

Log out. On the login page, find the Start fresh tick box and read the words beside it.
Tick it and log in as pat. The demo shop is back to the rows you started with.
Go to Shape of this shop. Write down the four numbers. That is this shop's shape in one line.
Click API & MCP. Read the three doors at the top: the screen, the script, and the helper.
Read the M.C.P. part. A helper joins with a token, acts as one named person, and can only draft.
Last idea: a promotion means one tested build is pointed at another home. The code does not change per shop; the switches do.

You should see: the same four numbers you could read to a support person to describe this shop exactly.

Why it matters: one build tested once, then shaped per shop by published switches. That is how one team can safely run many shops.

Check yourself

What extra does the health door tell a logged-in person?

The deep report: tape rows, open holes, open red holes, memory and the chain result. A stranger gets much less.

Which holes block a month lock?

Red ones, and any hole of a type the shop listed as blocking. Amber ones show but do not block.

How do you delete a shop?

You do not. Export it, then pause it or close it. The refusal names those three doors.

Why can you not close a shop with open months?

A closed shop never writes again, so closing with open months would freeze a half-finished book for ever.

What still works while a shop is paused?

Reading, and the export. Every write waits until a person with system.control resumes it.

What is a promotion?

The same tested build pointed at another home. The code does not change per shop; the published switches do.

If you forget everything else

Keep the four words: Happen. Draft. Stamp. Print.

And the one Stage 2 adds: a refusal is a feature. Read the words it used; they name the rule.