Finance Modal and Field Inventory

Shared dialog contract

Every dialog opens from a named button, receives initial focus, exposes an accessible title and description, uses explicit field labels, announces validation/status, locks duplicate submission while pending, supports Escape/cancel when safe, and returns focus to its trigger. Backdrop close must not discard an in-flight or completed accountable action. Destructive operations name the consequence and correction path and use the dashboard confirmation component.

The browser submits intent only. Actor, partner, event authorization, server time, capability, version, current lifecycle, exact calculation, idempotency, locks, maker-checker, and audit receipt are revalidated by the API/database.

Entry dialog

Routes/triggers: Overview or Transactions → Record manual entry. Roles: permitted finance maker.

Field	Control and rule	Effect
Kind	Required select: Income, Expense, Cash transfer	Determines permitted balanced journal pattern
Scope	Partner-wide or authorized event	Applies immutable partner/event dimensions
Amount/currency	Exact positive amount and ISO currency	Server posts exact balanced lines; currencies do not mix
Cash/source/destination accounts	Authorized account selects; transfer accounts differ	Controls journal lines and cash projection
Reference/description/date	Bounded text and valid posting date	Recorded in source and audit; closed period rejects

Submit posts once and refreshes canonical totals. Unbalanced account mapping, duplicate payload, stale scope, or locked period leaves no partial journal.

Outflow dialog

Routes/triggers: Overview or Outflows → Request outflow. Roles: finance maker.

Fields are Scope, Amount, Payee, Masked destination, Purpose, Due date/time, and optional Cash account. Amount is exact and positive; payee/purpose are required and bounded; destination remains masked; account must belong to the partner and match currency. Submit creates/submits according to the route contract and does not self-approve. Success exposes lifecycle and receipt; threshold/maker-checker decisions remain server-owned.

Import dialog

Routes/triggers: Reconciliation → Import statement. Roles: reconciler.

Fields include cash account, statement/file type, statement period, currency when not source-owned, and file chooser with documented size/type limits. The preview displays file digest, parsed/accepted/rejected/duplicate rows, opening/inflow/outflow/closing values, validation issues, and source cutoff. Preview never posts. Apply requires the exact preview identity and is idempotent.

Review dialog

Routes/triggers: Reconciliation preview/commit and review-required workflows. Roles: authorized independent reviewer/reconciler.

Fields include resolution summary, variance, unresolved/duplicate/excluded populations, evidence-package explanation, required review acknowledgement, reason/comment when policy requires, and current preview/version identity. Raw evidence URLs are absent. Commit seals only the reviewed population; stale preview, prohibited variance, incomplete evidence, lock, or maker-checker conflict blocks it.

Payment-default dialog

Routes/triggers: Overview or Settings → payment/default account action. Roles: finance account administrator.

Fields include direction/domain, partner default account, event inherit/override/disabled behavior, effective scope, and impact preview. Account options are active, partner-owned, and currency-compatible. Save is versioned and audited; it changes future/default selection and does not rewrite historical journal identity.

Period dialog

Routes/triggers: Overview or Close → create/close/reopen period. Roles: close owner/authorized approver.

Fields include period start/end, timezone/cutoff, currency, action, reason, readiness/checklist summary, unresolved exceptions, sign-offs, and explicit impact confirmation. Dates cannot overlap invalid period scope. Close requires prerequisites and independent sign-off; reopen requires capability, reason, and recent authentication when configured.

Record dialog

Routes/triggers: Payables, Receivables, Expenses, Budgets, Close, Automation, or domain create/edit. Roles: domain maker/administrator.

The dialog renders a typed schema for the selected domain, never a raw JSON textarea. Shared fields include record type, reference/name, scope, currency, exact amount or typed lines, owner/counterparty, dates, evidence, and current version. Options come from authorized partner/event/account/category/provider sources. Submit validates the domain lifecycle and returns the canonical record plus receipt.

Action dialog

Routes/triggers: Selected operational record → lifecycle action. Roles: capability-specific actor.

Fields include allowed Action, exact amount when applicable, payment/account reference, reason, evidence/acknowledgement, expected version, and impact summary. Only actions valid for the current state are shown, but the API rechecks. Approve, reject, pay, credit, write off, revise, close, replay, archive, and correction each retain distinct command semantics.

Custody-open dialog

Route/trigger: Custody → Open custody. Roles: authorized custodian.

Fields are Cash account (required), Event scope (optional/partner-wide), and guided PHP denomination counts for ₱1,000, ₱500, ₱200, ₱100, ₱50, and ₱20. Counts are non-negative integers. Opening float is calculated live and recalculated server-side. Submit binds the signed-in custodian and checkout time; raw denomination JSON and browser-supplied actor/time are not accepted.

Custody-action dialog

Route/trigger: Custody row → Manage. Roles: active custodian, handover recipient, or supervisor as required.

Field	Options/rule
Action	Record movement, Request handover, Accept handover, Count and submit close, Supervisor close
Movement type	Paid in, Paid out, Safe drop, Float adjustment, Count
Amount/count	Exact non-negative amount plus guided denomination rows; server recalculates count
Reference	Bounded operational reference
Handover recipient	Verified authorized finance user; cannot violate actor separation
Reason	Required, at least three characters; retained in audit

Both handover parties confirm the same count. Difference or dual-control failure blocks normal close.

Cash-account dialog

Route/trigger: Settings → Add/Edit cash account. Roles: finance.accounts.manage.

Fields are Name, Ledger account, Currency, Opening balance, Active/archive state, and impact preview. Ledger account must belong to the partner and match currency. Opening balance is exact. After postings exist, ledger account, currency, and opening balance are immutable; archive preserves history. Save returns the canonical account and audit receipt.

Integration profile dialog

Route/trigger: Integrations → Add/Edit integration. Roles: finance integration administrator.

Fields are Name, Direction (Inbound/Outbound/Bidirectional), Provider/standard (Bank feed, Accounting system, ISO 20022 camt, UBL 2.3, Peppol BIS, XBRL GL, SAF-T), Schema version, Currency, Reconciliation account, and Sync schedule (Hourly/Daily/Manual). Test and save performs preflight and records scopes, actor, and time. Credentials are never displayed after verification.

Route dialog

Routes/triggers: Overview or route-level Create/Open actions that need a safe destination/workflow choice. Roles: capability-dependent.

Fields identify target workflow/route, retained scope (partner/event/account/currency/cutoff), requested action, and any confirmation needed before navigation. The dialog must not imply a mutation occurred. Invalid or unauthorized retained context is dropped with a clear notice rather than applied to another partner/event.

Validation and error presentation

State	Dialog behavior
Missing/invalid field	Keep open, focus/associate the first error, preserve safe entries, show field and summary text
Permission or scope denial	Do not disclose unauthorized record existence; close or disable mutation and explain safe next step
Stale version	Show current safe state and require intentional refresh/reapply
Locked period/maker-checker	Name the control and authorized correction/reviewer path
Duplicate/idempotent replay	Show original result or payload conflict; never create a second record silently
Provider/rate/unavailable	Keep redacted correlation/retry guidance and preserve idempotency
Success	Announce result, close once safe, return focus, refresh canonical row/KPI/detail, and expose receipt

Current evidence

The local certificate inventories 13 dialog families and passes eight accessibility contracts. Browser evidence covers 18 modal controls and critical workflows for default payment account, cash account, custody denomination count, event authoritative totals, and automation drill-down. Route-specific mobile, denial, conflict, provider-failure, and real-stack dialog captures remain release gates.