What we studied
We collected specimen documents from ten P&I clubs: certificates of entry, premium invoices, commission and brokerage notes, debit and credit notes, each in the issuing club's own layout with invented parties and figures. We read every page of every file and catalogued what identifies each document and where its figures live. Alongside that, we reviewed the document reader from the previous build, to keep what it did well and to name what it must not pass on.
What the documents taught us
Three findings now shape the design. A document's issuer shows most reliably in its fixed print, the registration lines and regulatory footers that appear on every page, rather than in names and logos, which some documents barely carry. One entry produces many documents, instalments, class variants and corrections, and the references that should tie them together do not always agree with one another, so matching documents to an entry is the real work, not reading any single page. And these are layouts rather than letters: a label and its value sit beside each other on the page but far apart in a naive reading, so the reader must understand position, not just text.
How ingestion will work
The design is a pipeline of seven steps, and only the last one touches the book. A document is fingerprinted by its exact contents the moment it arrives, so the same file supplied twice changes nothing. It is then read in isolation, away from anything sensitive. The issuer and the kind of document are decided from several independent kinds of evidence, and where the evidence is not sufficient the system says so and asks, rather than guessing. Figures are extracted by named, versioned rules, and every figure carries its evidence: the page it came from, the exact place on that page, the rule that read it, and whether it was read from the document or calculated from other figures. The system then proposes which entry each document belongs to, showing which references matched and which did not, and holds anything that does not match cleanly for a person to decide.
Nothing enters the book without a person accepting it. The reader assists; it does not decide. Confidence orders the queue for review, and it never replaces the reviewer.
Showing the working
Any figure in the book can be traced back to the document it came from, the place on the page it was read, and the rule that read it, years later and by someone who was not there. The specimen documents themselves become the standing test: every one of them has an expected reading kept beside the code and checked automatically, so a change that alters any reading fails until the change is deliberate.
Also in this period
The threat model completed its adversarial review, six independent reviewers and an adjudicator, and its confirmed findings are applied throughout the document. The planning library was also reorganised so that every plan document carries the identifier of the work it plans, making the tracker and the plans navigable in both directions.