P3 review: the surface, docs and proofs

Split kernel::entry_flows into entry_movements and flows_of so the
reversal-mirror proof fits CI; prove runs the fast harnesses, prove-slow
the 8 slow ones (own job in scheduled CI), prove-all both. Laws in
verification.md renumbered 1-31 with a table of all 55 harnesses.

MCP docs checked against the 115 tools (about 60 fixes) with a test that
every tool is documented; rules.md cross-references fixed; bookspec
statuses and loader tightened; viewer notes wrap and accounts sort by
code; STATUS.md says P3 is built, cutover pending.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj

README.md

@@ -94,9 +94,20 @@ down, the units left over to the largest remainders, ties to the part
 listed first; rules.md B-13). An example that closes to the members
 declares `largest-remainder`, the rule a members close splits by.
 
-Required everywhere: the top-level keys, `[setup]` with its four keys and
-its accounts, the events (`events = []`, before `[setup]`, when nothing is
-posted), and at least one `[[expect]]` with values: a figure query's are
+`status` says what the expected values rest on: `AUTHORITY`, the cited
+authorities alone (a standard, a regulation, a statute, a court, the
+mechanics of double entry); `CONVENTION`, common practice where no
+authority governs (rules.md's CONVENTION); `CHOICE`, an owner's or the
+house's decision (a plan D-number, or a DECISION rules.md records) that
+some expected value depends on, even when authorities carry the rest. An
+example whose figures follow a decision cites it in `sources`.
+
+Required everywhere: the top-level keys (`title`, `rule`, `tags` and
+`sources` non-empty), `[setup]` with its four keys and its accounts, the
+events (`events = []`, before `[setup]`, when nothing is posted), and at
+least one `[[expect]]`. A value from a closed list (a type, a kind, a
+role, a form, a basis) is spelled exactly as written here. A figure
+query's values are
 exact decimal strings (`"2340.00"`, `"-12.50"`; never a float), a format
 query's are text (below). Amounts on lines are positive;
 the side gives the direction.
@@ -183,11 +194,12 @@ the side gives the direction.
   code, the company owes the party itself (a card's issuer, a lender,
   each member for what the members advanced: B-35 item 6). `tin_last4`:
   its TIN facts' last four (an SSN's); `w9_tin_last4`: its W-9's (a 1099
-  role's); `tin_purged = true`: the vault's copy purged, the facts kept.
+  role's); `tin_purged = true`: the vault's copy purged, the facts kept (needs
+  `tin_last4`).
   Never a full TIN. Each name once.
 - `[[setup.members]]` `{ name, capital_account, share?,
   distributions_account? }`: the members of a multi-member LLC. `share`
-  is the member's share of income, an exact decimal fraction (`"0.5"`,
+  is the member's share of income, an exact decimal fraction above zero (`"0.5"`,
   `"0.3333"`); every member has one or none does, and the shares sum to
   1. A close to the members, `members_equity`, `k1`, `k1_tax_basis` and
   `k1_reconciliation` need them. `distributions_account`: the member's
@@ -211,7 +223,8 @@ the side gives the direction.
 - `[[setup.instruments]]` `{ label, kind, account, last4?, owner? }`: a
   payment method (B-19): `kind` `bank`, `business_card`, `member_card`,
   `member_cash_or_check` or `platform`; `account` the code it pays
-  through; `owner` a party's name (informational). A business card's
+  through; `owner` a party's name in `setup.parties` (informational); each label
+  once. A business card's
   liability is a card account (B-35 item 5): while none is recorded, a
   liability whose name says "card", not "gift card", is.
 - `payee` on an event: the payee (by name, one of `setup.payees`) the
@@ -232,7 +245,7 @@ the side gives the direction.
   `"members"` (split by share, in the order listed) or
   `"retained_earnings"`. A close to the members splits cumulatively, each
   close giving each member their split of everything the members' closes
-  have closed less what earlier closes gave them; `rounding = "per-close"`
+  have closed less what earlier closes gave them; `rounding = "per-close"` (members only)
   splits that close's net on its own instead (books from an engine that
   rounded each close by itself). A close must have something to close: it
   posts one entry like any other event.
@@ -292,8 +305,8 @@ answers is refused, never skipped.
 | query | dates | values | checked by |
 |---|---|---|---|
 | `cash_flow` | `from`, `to` | figures (below) | `ledger-core` `tests/bookspec.rs` |
-| `trial_balance` | `as_of` | each account's balance by code, debits less credits (a credit balance negative), every account listed | `ledger-core` `tests/bookspec.rs` |
-| `profit_and_loss` | `from`, `to` | each revenue and expense account's activity by code, on its normal side, closing entries left out, every one listed; `net_income`, revenue less expenses | `ledger-core` `tests/bookspec.rs` |
+| `trial_balance` | `as_of` | each account's balance by code, debits less credits (a credit balance negative), every account of `setup.accounts` listed (not those the books create) | `ledger-core` `tests/bookspec.rs` |
+| `profit_and_loss` | `from`, `to` | each revenue and expense account's activity by code, on its normal side, closing entries left out, every one of `setup.accounts` listed; `net_income`, revenue less expenses | `ledger-core` `tests/bookspec.rs` |
 | `entry` | `entry = N`, no dates | the lines of event N's entry, `"<code>.debit"` and `"<code>.credit"` each the sum of that account's lines on that side, every line of the entry named | `ledger-core` `tests/bookspec.rs` |
 | `balances` | `as_of` | each account named by code, its balance on its normal side (a member's capital after a loss is negative); the example names the accounts it shows | `ledger-core` `tests/bookspec.rs` |
 | `members_equity` | `from`, `to` | the statement of changes in members' equity (rules.md B-13): `"<member>.beginning"`, `.contributions`, `.net_income`, `.distributions`, `.other`, `.ending`; the example names the figures it shows | `ledger-core` `tests/bookspec.rs` |

examples/1099-a-members-check-through-financing-counts.toml

@@ -13,11 +13,12 @@ member's payment whose method isn't recorded is undetermined, never
 guessed; the payee is reportable only if what certainly counts reaches the
 threshold.
 """
-status = "AUTHORITY"
+status = "CHOICE"
 sources = [
   "Treas. Reg. §1.6041-1(a)(1)(i), (e)(1) (docs/spec/sources/irs-1099-payment-method.md)",
   "Treas. Reg. §1.6041-1(a)(1)(iv)",
   "26 U.S.C. §6041(a), as amended by Pub. L. 119-21 §70433 (docs/spec/sources/irs-1099-thresholds.md)",
+  "DECISION (owner, plan/served.md P3 defect 12; D-40, 2026-10-20): a payment through financing with no payment method recorded is undetermined (wanderbooks rules.md B-19)",
 ]
 tags = ["1099", "financing", "member-paid", "instruments"]
 

examples/assets-723-basis-apart-from-depreciable-basis.toml

@@ -3,13 +3,14 @@
 id = "assets-723-basis-apart-from-depreciable-basis"
 title = "Property contributed from personal use: the §723 basis apart from the depreciable basis"
 rule = "The partnership's basis in property a partner contributes is the partner's adjusted basis (IRC §723). Its depreciable basis, for property converted from personal use, is the lesser of fair market value and that adjusted basis at conversion (CHOICE recorded by the owner as D-41, the CPA to confirm). The §704(c) built-in gain or loss is fair market value less the §723 basis at contribution; a built-in loss counts only for the contributing partner (IRC §704(c)(1)(C))."
-status = "AUTHORITY"
+status = "CHOICE"
 sources = [
   "26 U.S.C. §723",
   "Treas. Reg. §1.168(i)-4(b)(1): 'the lesser of its fair market value or its adjusted depreciable basis'",
   "IRS Pub. 946 (2025), Property changed from personal use",
   "Treas. Reg. §1.704-3(a)(3)(ii)",
   "26 U.S.C. §704(c)(1)(C)",
+  "DECISION D-41 (owner, 2026-10-20): the depreciable basis of contributed personal-use property is the lesser of its fair market value and the member's adjusted basis, the CPA to confirm (wanderbooks plan/served.md; rules.md B-25)",
 ]
 tags = ["fixed-assets", "tax-basis", "partnerships", "704c"]
 

examples/assets-a-reversed-run-is-not-posted.toml

@@ -6,7 +6,7 @@ rule = "The accumulated depreciation the books carry for an asset counts each ru
 status = "AUTHORITY"
 sources = [
   "wanderbooks docs/spec/rules.md B-8, B-9 (a correction is an opposite entry; reversing the reversal reinstates the original)",
-  "wanderbooks docs/spec/rules.md B-24",
+  "wanderbooks docs/spec/rules.md B-15 rules 6 and 8",
 ]
 tags = ["fixed-assets", "depreciation", "reversal"]
 

examples/assets-acquired-before-in-service.toml

@@ -3,11 +3,12 @@
 id = "assets-acquired-before-in-service"
 title = "An asset is on the register from acquisition and depreciates from its in-service date"
 rule = "Depreciation starts on the day the asset is placed in service; the asset is on the register (and the books carry its cost) from the day the company acquired it, the date of the entry that put it on the books."
-status = "AUTHORITY"
+status = "CHOICE"
 sources = [
   "ASC 360-10-35-4 (cost allocated over the periods the asset serves)",
   "IRS Pub. 946 (2025), Placed in Service: 'ready and available for a specific use' (for tax depreciation, the CPA's)",
   "wanderbooks docs/spec/rules.md B-15, B-24",
+  "DECISION (owner, 2026-10-20; wanderbooks plan/served.md P3, \"Settled in design\"): an asset's acquired date comes from the entry it is linked to (rules.md B-15 rule 7)",
 ]
 tags = ["fixed-assets", "dates"]
 

examples/assets-four-contributed-devices.toml

@@ -3,12 +3,13 @@
 id = "assets-four-contributed-devices"
 title = "Each contributed device takes the lower of its value and its basis; gains and losses are per property"
 rule = "Each item of contributed property is its own: depreciable basis is the lesser of its fair market value and the contributor's adjusted basis; its built-in gain or loss is its own, and gains and losses of different properties are never netted."
-status = "AUTHORITY"
+status = "CHOICE"
 sources = [
   "Treas. Reg. §1.168(i)-4(b)(1)",
   "Treas. Reg. §1.704-3(a)(2): section 704(c) applies 'on a property-by-property basis'",
   "Treas. Reg. §1.704-3(a)(3)(ii)",
   "26 U.S.C. §704(c)(1)(C)",
+  "DECISION D-41 (owner, 2026-10-20): the depreciable basis of contributed personal-use property is the lesser of its fair market value and the member's adjusted basis, the CPA to confirm (wanderbooks plan/served.md; rules.md B-25)",
 ]
 tags = ["fixed-assets", "tax-basis", "partnerships", "704c"]
 

examples/depreciation-reversal-before-its-run-is-refused.toml

@@ -1,8 +1,11 @@
 id = "depreciation-reversal-before-its-run-is-refused"
 title = "A depreciation run can't be reversed on a day before its own"
 rule = "A correction comes after what it corrects: a depreciation run, or a reversal of one, can't be reversed on a day before its own. A run of March reversed on Jan 31 would leave January and February with negative depreciation."
-status = "AUTHORITY"
-sources = ["Pacioli 1494, ch. 31"]
+status = "CONVENTION"
+sources = [
+  "Pacioli 1494, ch. 31",
+  "wanderbooks docs/spec/rules.md B-15 rule 6, B-9: a correction comes after what it corrects (CONVENTION)",
+]
 tags = ["depreciation", "reversal", "refusal", "p3-defect-22"]
 
 [setup]

examples/iif-quickbooks-journal-file.toml

@@ -32,7 +32,7 @@ id = "iif-quickbooks-journal-file"
 appendix = "formats"
 title = "A QuickBooks Desktop journal file as of a day"
 rule = "An IIF journal file as of a day D MUST declare every account first (NAME, ACCNTTYPE, ACCNUM), then hold one GENERAL JOURNAL transaction per posted entry dated on or before D, period closes excepted, in the order posted: a TRNS line and SPL lines, debits positive and credits negative, dated M/D/YYYY, each numbered (DOCNUM) with the entry's id; then ENDTRNS. It MUST be ASCII text, every line ending CR LF, no field holding a tab, a line break or a double quote; an account name level MUST be at most 31 characters and no two NAMEs alike, an account number at most 7 characters and no two alike (else left out), a memo at most 4,095 characters; each parent MUST be declared before its subaccounts, and a subaccount whose QuickBooks type differs from its parent's MUST be written at the top level. Each text written differently from the books MUST be reported."
-status = "AUTHORITY"
+status = "CHOICE"
 sources = [
   "Intuit, IIF Overview: import kit, sample files, and headers: IIF files are ASCII text, tab-separated; an account not already in the company file is created as a new bank account (docs/spec/sources/intuit-iif.md)",
   "Intuit, IIF Import Kit, IIF Header Help !TRNS, !SPL, !ACCNT: TRNS and SPL lines then ENDTRNS; \"Debit amounts are always positive, credit amounts are always negative\"; DOCNUM is the transaction's number; a subaccount's NAME its parents' names first, joined by colons (docs/spec/sources/intuit-iif.md)",
@@ -40,6 +40,7 @@ sources = [
   "Intuit, Character limitations for fields in QuickBooks (US, updated 8/3/2026): Account Name 31, Account Numbers 7, Memo 4,095 (docs/spec/sources/intuit-iif.md)",
   "Intuit, Add, edit, or delete accounts in QuickBooks Desktop (updated 8/4/2026): \"The parent and subaccount must be the same account type.\" (docs/spec/sources/intuit-iif.md)",
   "Reckon, IIF import changes a double quote to a single one by design; J. Clark (2003): QuickBooks uses double quotes as text delimiters (docs/spec/sources/intuit-iif.md; not Intuit)",
+  "DECISION D-36 (owner, 2026-10-20): plain ASCII, what isn't ASCII transliterated and listed; CR LF; DOCNUM the entry's id; closes left out (wanderbooks plan/served.md; rules.md B-34)",
 ]
 tags = ["iif", "quickbooks", "as-of", "format", "transliteration"]
 

examples/members-close.odd-cent-across-closes.toml

@@ -2,7 +2,11 @@ id = "members-close.odd-cent-across-closes"
 title = "An odd cent split cumulatively across closes, a close to retained earnings between"
 rule = "Each close to the members MUST give each member their largest-remainder split of everything closed to the same members and shares so far, to the minor unit, less what earlier closes gave them; a close to retained earnings allocates nothing to the members and MUST NOT restart the count."
 status = "CHOICE"
-sources = ["26 U.S.C. §704(a)", "Treas. Reg. §1.704-1(b)(2)(iv)(b)"]
+sources = [
+  "26 U.S.C. §704(a)",
+  "Treas. Reg. §1.704-1(b)(2)(iv)(b)",
+  "DECISION (owner, 2026-10-13: largest remainder; D-10, 2026-10-16: counted from the first close) (wanderbooks rules.md B-13)",
+]
 tags = ["partnership", "close", "rounding", "book", "us"]
 
 # The regression this example comes from (wanderbooks P3 defect 17, audit

examples/members-close.statement-before-and-after-a-close.toml

@@ -2,7 +2,10 @@ id = "members-close.statement-before-and-after-a-close"
 title = "A member's capital on a day is the same before and after its month closes"
 rule = "The statement of members' equity MUST split earnings not yet closed the way the next close to the members will (each member's split of everything closed plus those earnings, less their split of what was closed), so a member's capital as of a day MUST NOT change when a period ending on or before it is closed."
 status = "CHOICE"
-sources = ["Treas. Reg. §1.704-1(b)(2)(iv)(b)"]
+sources = [
+  "Treas. Reg. §1.704-1(b)(2)(iv)(b)",
+  "DECISION D-38 (owner, 2026-10-20): the statement splits unclosed earnings the same running way as the closes (wanderbooks rules.md B-13)",
+]
 tags = ["partnership", "close", "rounding", "statement", "book", "us"]
 
 # Two members at 50/50; January's cent is closed to them, February's is

examples/members-close.thirds-over-twelve-months.toml

@@ -2,7 +2,11 @@ id = "members-close.thirds-over-twelve-months"
 title = "Three members at a third each, twelve monthly closes"
 rule = "Each monthly close to the members MUST give each member their largest-remainder split of everything closed so far, to the minor unit, less what earlier closes gave them, so after every close each member's total is less than one minor unit from their exact share."
 status = "CHOICE"
-sources = ["26 U.S.C. §704(a)", "Treas. Reg. §1.704-1(b)(2)(iv)(b)"]
+sources = [
+  "26 U.S.C. §704(a)",
+  "Treas. Reg. §1.704-1(b)(2)(iv)(b)",
+  "DECISION (owner, 2026-10-13: largest remainder; D-10, 2026-10-16: counted from the first close) (wanderbooks rules.md B-13)",
+]
 tags = ["partnership", "close", "rounding", "book", "us"]
 
 # A third each can't be written as decimal shares summing to one, so the

examples/members-close.true-up-of-a-per-close-split.toml

@@ -2,7 +2,10 @@ id = "members-close.true-up-of-a-per-close-split"
 title = "Closes rounded one at a time, trued up by the first cumulative close"
 rule = "When earlier closes split each close's net on its own, the first cumulative close that posts an entry MUST give each member their split of everything closed to the members, less what the earlier closes gave them, so it trues up the rounding they left; until it posts, the statement of members' equity MUST show the capital those closes posted, not the pending true-up."
 status = "CHOICE"
-sources = ["Treas. Reg. §1.704-1(b)(2)(iv)(b)"]
+sources = [
+  "Treas. Reg. §1.704-1(b)(2)(iv)(b)",
+  "DECISION D-10 (owner, 2026-10-16): members closes counted from the first close, so a later close carries any earlier rounding as a true-up (wanderbooks rules.md B-13)",
+]
 tags = ["partnership", "close", "rounding", "statement", "book", "us"]
 
 # Books migrated from an engine that rounded each close on its own: three

examples/p3-party-distribution-still-owed.toml

@@ -20,11 +20,12 @@ promise: it counts nothing until it is paid, then once, as paid. The
 statement of members' equity counts a distribution when it is declared,
 so party totals catch up with it when it is paid.
 """
-status = "AUTHORITY"
+status = "CHOICE"
 sources = [
   "Helvering v. Price, 309 U.S. 409, 412-413 (1940): a promise to pay is not payment (wanderbooks docs/spec/sources/helvering-v-price-1940.md)",
   "Treas. Reg. §1.704-1(b)(2)(iv)(b)(4)-(5): a partner's capital account falls by the money and the property distributed (docs/spec/sources/irs-capital-accounts.md)",
   "DECISION (owner, 2026-10-20): a member's entry counts what moved their capital; money is cash, cards, the members' financing and loans (rules.md B-35)",
+  "DECISION (owner, 2026-10-20): property distributed counts at the books' carrying amount, not its fair market value (wanderbooks rules.md B-35 item 3)",
 ]
 tags = ["parties", "members", "distributions", "promises", "in-kind", "money"]
 

examples/p3-party-gift-card-is-a-promise.toml

@@ -16,7 +16,7 @@ owes its customers in service (deferred revenue), a promise. Selling one
 is money received from the buyer; redeeming it moves no money and counts
 nothing.
 """
-status = "CONVENTION"
+status = "CHOICE"
 sources = [
   "DECISION (owner, 2026-10-20): money is cash, cards, the members' financing and loans; every other liability is a promise, counted when settled (wanderbooks rules.md B-35 item 5)",
   "Helvering v. Price, 309 U.S. 409, 412-413 (1940): a promise to pay is not payment (docs/spec/sources/helvering-v-price-1940.md)",

examples/p3-party-own-liability-never-pays.toml

@@ -15,7 +15,7 @@ seller's own note, a distribution credited to what the members are owed.
 It counts when it is paid. Property a member contributes subject to a
 loan counts at its value net of the loan, in kind.
 """
-status = "AUTHORITY"
+status = "CHOICE"
 sources = [
   "Helvering v. Price, 309 U.S. 409, 412-413 (1940): a promise to pay, even a secured one, is not payment (wanderbooks docs/spec/sources/helvering-v-price-1940.md)",
   "Treas. Reg. §1.704-1(b)(2)(iv)(b)(2): property contributed, net of liabilities the partnership takes it subject to (docs/spec/sources/irs-capital-accounts.md)",

examples/p3-party-reversed-card-payment.toml

@@ -14,9 +14,10 @@ their own funds (Dr card / Cr due to members), tagged with the card's
 issuer, is paid to the issuer; its reversal takes that back, so the pair
 nets to zero; reversing the reversal pays it again.
 """
-status = "AUTHORITY"
+status = "CHOICE"
 sources = [
   "Pacioli, Summa (1494), Geijsbeek tr.: a mistake is corrected by the opposite entry (wanderbooks docs/spec/sources/pacioli-1494.md, rules.md B-9)",
+  "DECISION D-42 (owner, 2026-10-20): what a member pays for the company through the members' financing is money: cash borrowed and spent (wanderbooks plan/served.md; rules.md B-14 rule 11, B-35 items 5 and 8)",
 ]
 tags = ["parties", "reversals", "liabilities"]
 

examples/p3-party-signs-and-reversals.toml

@@ -19,12 +19,13 @@ negated. A bill or invoice moves nothing with the party yet (neither).
 Party totals on basis cash count the cash parts, on basis all the cash
 and in-kind parts, each on its root original's side.
 """
-status = "CONVENTION"
+status = "CHOICE"
 sources = [
   "Pacioli, Summa (1494), Geijsbeek tr., ch. 36: debit is what owes, credit what is owed (wanderbooks docs/spec/sources/pacioli-1494.md)",
   "Treas. Reg. §1.704-1(b)(2)(iv)(b)(1)-(2), (4)-(5): a partner's capital account rises by money and property contributed, falls by money and property distributed (docs/spec/sources/irs-capital-accounts.md)",
   "Helvering v. Price, 309 U.S. 409, 412-413 (1940): a promise to pay is not payment (docs/spec/sources/helvering-v-price-1940.md)",
   "DECISION (owner, 2026-10-20): a member's entry counts what moved their capital (wanderbooks rules.md B-35)",
+  "DECISION D-42 (owner, 2026-10-20): what a member pays for the company through the members' financing is money: cash borrowed and spent (wanderbooks plan/served.md; rules.md B-14 rule 11, B-35 items 5 and 8)",
 ]
 tags = ["parties", "signs", "reversals", "members", "in-kind", "basis"]
 

examples/p3-party-tin-last4.toml

@@ -14,7 +14,7 @@ the K-1), else its W-9 facts'; the two never disagree. A TIN purged from
 the vault keeps its last four in the books. A party with neither has
 none.
 """
-status = "AUTHORITY"
+status = "CHOICE"
 sources = [
   "Treas. Reg. §301.6109-4(a): a truncated TIN shows the last four digits (wanderbooks docs/spec/sources/irs-truncated-tin.md)",
   "DECISION (owner, 2026-10-15): a party's TIN facts and W-9 facts never disagree (wanderbooks ledger-core parties INVARIANT 2a)",

examples/partnership-k1-tax-basis-capital.toml

@@ -8,6 +8,7 @@ sources = [
   "Instructions for Form 1065 (2020), Item L: 'you must use the tax basis method this year'",
   "26 U.S.C. §723",
   "Treas. Reg. §1.704-3(a)(3)(ii)",
+  "DECISION D-41 (owner, 2026-10-20): the K-1 worksheet reports tax-basis capital beside the book figures (wanderbooks plan/served.md; rules.md B-36)",
 ]
 tags = ["partnerships", "k1", "tax-basis", "capital"]
 

examples/rename-changes-no-amount.toml

@@ -15,7 +15,7 @@
 id = "rename-changes-no-amount"
 title = "Renaming an account changes its label, never an amount"
 rule = "Entries name accounts by identity, not by name, so renaming an account MUST change no posted entry, line, balance or statement amount, and every report, past periods included, MUST print the new name. A new name MUST be refused when it is blank, the name the account has, one another account under the same parent has (ignoring capitals and surrounding space), one that holds a run of nine digits, or not one line of at most 200 characters."
-status = "AUTHORITY"
+status = "CHOICE"
 sources = [
   "Pacioli, Summa de arithmetica (1494), ch. 36: \"You should not write backward, but always forward\" (posted is forever: AUTHORITY; docs/spec/sources/pacioli-1494.md)",
   "Rev. Proc. 98-25 §5.01: \"the relationship (i.e., audit trail): (a) between the total of the amounts in the taxpayer's machine-sensible records by account and the account totals in the taxpayer's books\" (an amount never moves with a name: AUTHORITY; docs/spec/sources/irs-records.md)",