letsort

Add honest "HMRC approved" software post (Pillar 1 piece 3) (#39) Third Month 2 post: the citation-magnet asset on how HMRC actually publishes its recognised-software list. New post /blog/hmrc-approved-mtd-software-is-a-myth. Angle: HMRC uses "recognised", never "approved" for MTD software, and does not recommend any product; it removed its browsable table on 31 July 2025 for a personalised finder. Original data: we walked HMRC's finder on 21 July 2026 as a UK-property landlord and it returned 100 recognised products, 28 with a free version; the post teaches readers to run it themselves and states our own status honestly (not yet recognised, in the process). No per-competitor table by design. Adversarial fact-check per docs/blog-factcheck-process.md: 0 CRITICAL, 1 MAJOR (fixed), 4 MINOR. MAJOR: scoped the "HMRC never says approved" claim to "for MTD software" in the meta description, FAQ 1 and takeaways, since HMRC uses "approved" elsewhere. Filter labels tightened to exact captured strings. Recorded in do

Add HMRC API changelog post: Individual Losses v6.0 to v7.0 (#38 series) (#38) Starts Pillar 2, the HMRC API changelog series, with entry one, off our spec-change monitor. New post /blog/the-hmrc-losses-api-changed-in-june (category "HMRC API Changelog") covers the dated timeline verified against HMRC's live changelog: v4.0/v5.0 retired (9 Jan), v6.0 capped at 2025-26 via RULE_TAX_YEAR_FOR_VERSION_NOT_SUPPORTED (22 Jan), v7.0 to Sandbox (23 Mar) then Production (16 Jun), the three unified "Losses and Claims" endpoints, and the Sandbox-only Retrieve ITSA Penalties endpoint (15 Jun). Registered in posts.ts with Article + FAQ JSON-LD. Adversarial fact-check per docs/blog-factcheck-process.md: 0 CRITICAL, 0 MAJOR; every date, version, error code and endpoint name confirmed verbatim. Two optional MINOR fixes applied. Recorded in docs/blog-factchecks/. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Add fraud prevention headers blog post; fix two stale Public-Port artifacts (#37) Opens Month 2 of the blog roadmap with Pillar 1 piece 4, drawn from our own CMQAA-696 production work: what leaves a landlord's machine on every MTD filing. New post /blog/why-your-mtd-software-asks-for-your-device-details explains the fourteen fraud prevention headers we send, the Gov-Client-Public-Port/echo-service story as first-hand moat content, the two we omit and why, and an honest data-protection answer. Registered in posts.ts with Article + FAQ JSON-LD. Adversarial fact-check run per docs/blog-factcheck-process.md: 0 CRITICAL, 2 MAJOR (both fixed pre-publication), 4 MINOR (3 fixed). Recorded in docs/blog-factchecks/. Every verbatim HMRC quote and the 14/2 header count survived the refuting pass. Fixed two stale artifacts the post would contradict, both predating the 16 July CMQAA-696 fix: the pillar post ("three headers we do not send" -> two, with a cross-link and the false "conditional" attribution corrected) and

Mark the two pre-refusal CMQAA-696 reply drafts as superseded (#35) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Record Public-Port merge + deploy verification; plain-text reply doc (#34) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Populate Gov-Client-Public-Port via a connection-echo service (CMQAA-696) (#33) * Populate Gov-Client-Public-Port from a connection-echo service HMRC (ticket CMQAA-696) will not grant production approval while Gov-Client-Public-Port is omitted. Cloudflare Workers cannot see the client's TCP source port, so the browser now collects it from echo.letsort.co.uk: a reverse proxy we operate outside Cloudflare that terminates the device's TLS connection directly and reports the source IP/port it observed, plus the collection timestamp. The spec allows collection "at the Web Application Firewall (WAF), load balancer, reverse proxy or the server process itself". - web: fetch the echo (3s timeout, 5-minute sessionStorage cache) and forward x-client-public-ip / x-client-port / x-client-public-ip-timestamp; degrade gracefully to the previous behaviour when unreachable - web: allow echo.letsort.co.uk in CSP connect-src - api: prefer the echo observation wholesale so IP, port and timestamp describe one connection;

Add the MTD filing pillar post, closing Sprint 1 (#32) "What actually happens when your software files an MTD update": six API calls, the sixteen fraud prevention headers, the four-hour token, HMRC's production gate. The adversarial fact-check ran BEFORE merge and caught 4 CRITICAL and 4 MAJOR errors. None reached a reader. The verifier's diagnosis names a new failure mode: "The article's research is better than its prose. Every error is the same error, which is a hedged HMRC sentence being flattened into an unhedged assertion because the unhedged version is a better line." That is distinct from the earlier posts, which inherited other people's errors. This one invented its own by dropping HMRC's qualifiers. The worst instance welded two separate HMRC sentences into one and presented it as a quotation, fabricating a detail about a government approval process: the "variety of user IDs, devices, browsers and screen sizes" line is HMRC telling developers how to test their own software, not a descript

Add the compliance-year pillar post, and fix a withdrawn duty in the checker (#31) Fourth post, and the first through the adversarial fact-check BEFORE merge rather than after. The gate caught five blocking errors and none of them reached a reader. Two were the exact failure the post was written to mock: - EICR penalty drafted as £30,000. It is £40,000, raised 1 May 2026 by SI 2025/1043. A stale money figure, in an article about stale figures. - A caveat box claimed the 28-day pet response window was not in the Act. It is: Housing Act 1988 s16A(1)(c). Published, that would have been a false statement about the contents of a statute, in a post arguing nobody else checks primary sources. One was actively harmful: the draft gave landlords "3 months to apply" after a council designates a licensing area. Backwards. The 3 months is the council's lead-in before the scheme takes effect; once live you commit an offence from day one, unlimited fine plus rent-repayment-order exposure. It invented a safe harbour

Make the adversarial fact-check mandatory for every blog post (#30) An adversarial verifier over the three published posts found six errors serious enough to mislead a landlord about money. None were caught by careful writing, and none by citing sources: two of them came FROM citing GOV.UK, accurately, from pages that were years out of date. Only the pass that was told to refute the article caught them. A confirming reviewer reads "there are no penalties for missing a quarterly update deadline" and finds the GOV.UK line saying exactly that. A refuting reviewer reads the rest of the page and finds the sentence four paragraphs down that we had missed. That distinction is the entire process. - docs/blog-factcheck-process.md: the rule, the exact verifier prompt (the aggression is load-bearing; do not soften it), and the trap classes that have actually bitten us. Also a register of standing unverified claims, each with the experiment that would close it. - docs/blog-factchecks/<slug>.md: an evidence trail

Fact-check all three posts and fix what was wrong (#29) * Fact-check all three posts against Tier 1 sources and fix what was wrong Ran an adversarial verifier over each published post, instructed to refute every claim against GOV.UK / HMRC / legislation.gov.uk rather than confirm it. It found six errors serious enough to mislead a landlord about money, all now fixed. PENALTY POST - The "honest caveat" box said we could not resolve whether the first-year easement reaches late payment. It is resolved, on the same GOV.UK page we quote: "16 to 30 days late: 3% of the tax owed at day 15, or no penalty if it's your first year." Replaced the caveat with the answer. - FAQ on late payment was wrong three ways: it stated the first-year 30-day easement as the permanent day-15 rule, called the 10% daily charge "interest" when it is a penalty, and omitted late payment interest (base rate + 4%) entirely. Rewritten. - "HMRC blocks your Final Declaration until all four are filed" is not how it works. HMRC: "Th