feat(parties): an email and default terms per side (P4b S4.2)

A customer's email is copied onto an invoice's bill-to snapshot at issue,
and a party's default terms (one as our customer, one as our vendor) are
the fallback a document's due date takes when the document itself names
none (A-13, rules.md B-39). Both are journaled as party.updated facts and
guarded by documents_v2: in books that have not declared it the write is
refused with the upgrade remedy and journaling nothing, and replay gives
the same directory back.

An email must be one plain address: one @, no spaces, no full TIN (the
party text rule already refuses nine digits). Terms are typed and already
canonical, so there is no second spelling to check. A party.updated naming
a field this version does not know is now NewerJournal, never corrupt
(B-27): an older version must say update, not damage; a known field with a
malformed value is still corrupt.

crates/ledger-store/src/store.rs

@@ -1603,6 +1603,9 @@ impl Store {
         field: ledger_core::PartyField,
     ) -> Result<(), StoreError> {
         self.ledger.check_update_party(id, &field)?;
+        if field.needs_documents_v2() {
+            self.ensure_feature(crate::format::DOCUMENTS_V2)?;
+        }
         let line = self.append_journal("party.updated", json!({"id": id, "change": field}))?;
         self.ledger.update_party(id, field)?;
         apply_line_to_sqlite(&self.conn, &line)?;
@@ -6203,6 +6206,19 @@ fn replay_line(
             }
         }
         "party.updated" => {
+            // A field this version doesn't know: a newer one wrote it
+            // (rules.md B-27). A known field with a bad value is damage.
+            if let Some(field) = p
+                .get("change")
+                .and_then(|c| c.get("field"))
+                .and_then(Value::as_str)
+                && !ledger_core::PartyField::known_field(field)
+            {
+                return Err(crate::format::newer_content(
+                    line,
+                    format!("the party field {field}"),
+                ));
+            }
             let field: ledger_core::PartyField = serde_json::from_value(p["change"].clone())
                 .map_err(|_| StoreError::JournalCorrupt("party.updated change".into()))?;
             ledger.update_party(get_u64(p, "id")?, field)?;

crates/ledger-store/tests/format.rs

@@ -1200,6 +1200,55 @@ fn an_unknown_schedule_convention_is_newer_not_corrupt() {
     assert_corrupt(Store::open(&dir));
 }
 
+/// P4b S4.2 (rules.md B-27): a `party.updated` naming a field this version
+/// doesn't know is newer, never corrupt; a known field with a malformed
+/// value is still damage.
+#[test]
+fn an_unknown_party_field_is_newer_not_corrupt() {
+    let dir = test_dir("unknown-party-field");
+    books(&dir);
+    let seq = append(
+        &dir,
+        &[
+            (
+                "party.updated",
+                json!({"id": 0, "change": {"field": "ssn", "value": "x"}}),
+            ),
+            (
+                "fx.rate_set",
+                json!({"currency": "EUR", "date": "2026-10-01", "rate": "1.10"}),
+            ),
+        ],
+    )[0];
+    std::fs::remove_file(dir.join(db_file())).unwrap();
+    assert_newer(
+        Store::open(&dir),
+        seq,
+        "party.updated",
+        "the party field ssn",
+        false,
+    );
+    assert_newer(
+        Snapshot::load(&dir),
+        seq,
+        "party.updated",
+        "the party field ssn",
+        false,
+    );
+
+    let dir = test_dir("bad-party-field-value");
+    books(&dir);
+    append(
+        &dir,
+        &[(
+            "party.updated",
+            json!({"id": 0, "change": {"field": "email", "value": 5}}),
+        )],
+    );
+    std::fs::remove_file(dir.join(db_file())).unwrap();
+    assert_corrupt(Store::open(&dir));
+}
+
 /// P3 (R3; rules.md B-27): a schedule month reversed within its month is
 /// posted again only in books that declare journal feature month_reposting
 /// (an older version would refuse the second schedule.posted as posted

crates/ledger-store/tests/parties.rs

@@ -318,6 +318,111 @@ fn update_party_journals_party_updated() {
     assert_eq!(got.notes.as_deref(), Some("net 30"));
 }
 
+/// Oracle: P4b S4.2 (A-13, rules.md B-39, R-A step 3): a party's email and
+/// default terms are `party.updated` facts the `documents_v2` feature
+/// guards. In books that haven't declared it they are refused, journaling
+/// nothing; after the upgrade they journal, replay gives them back, and an
+/// email in no plain address shape or holding a full TIN is refused.
+#[test]
+fn a_party_takes_an_email_and_terms_under_documents_v2() {
+    let dir = test_dir("email-terms");
+    // Books as an older version wrote them: no features declared, as the
+    // owner's live books are until the go-ahead (D-39).
+    let mut s =
+        Store::create_in_format(&dir, Currency::USD, &ledger_store::JournalFormat::default())
+            .unwrap();
+    let id = s.add_party("Acme", &[]).unwrap();
+    let net = ledger_core::Terms::parse("Net 30").unwrap();
+    let early = ledger_core::Terms::parse("2/10 net 30").unwrap();
+    let fields = [
+        PartyField::Email(Some("billing@acme.example".into())),
+        PartyField::DefaultTermsAsCustomer(Some(net.clone())),
+        PartyField::DefaultTermsAsVendor(Some(early.clone())),
+    ];
+    for field in &fields {
+        refused_nothing_journaled(&mut s, &dir, &format!("{field:?} before consent"), |s| {
+            s.update_party(id, field.clone())
+        });
+    }
+    assert!(s.upgrade_format().unwrap().is_some(), "the go-ahead");
+
+    let ((), p) = one_event(&mut s, &dir, "party.updated", |s| {
+        s.update_party(id, fields[0].clone()).unwrap()
+    });
+    assert_eq!(
+        p["change"],
+        json!({"field": "email", "value": "billing@acme.example"})
+    );
+    let ((), p) = one_event(&mut s, &dir, "party.updated", |s| {
+        s.update_party(id, fields[1].clone()).unwrap()
+    });
+    assert_eq!(p["change"]["field"], json!("default_terms_as_customer"));
+    assert_eq!(
+        serde_json::from_value::<ledger_core::Terms>(p["change"]["value"].clone()).unwrap(),
+        net,
+        "the journal carries the terms whole"
+    );
+    let ((), p) = one_event(&mut s, &dir, "party.updated", |s| {
+        s.update_party(id, fields[2].clone()).unwrap()
+    });
+    assert_eq!(p["change"]["field"], json!("default_terms_as_vendor"));
+    assert_eq!(
+        serde_json::from_value::<ledger_core::Terms>(p["change"]["value"].clone()).unwrap(),
+        early,
+    );
+
+    let got = s.ledger().get_party(id).unwrap();
+    assert_eq!(got.email.as_deref(), Some("billing@acme.example"));
+    assert_eq!(
+        got.default_terms_as_customer.as_ref().map(|t| t.describe()),
+        Some("Net 30".to_string())
+    );
+    assert_eq!(
+        got.default_terms_as_vendor.as_ref().map(|t| t.describe()),
+        Some("2/10 net 30".to_string())
+    );
+
+    // Refusals, journaling nothing: no plain address shape, or a full TIN.
+    for bad in [
+        "billing",
+        "a b@example.com",
+        "a@@example.com",
+        "123-45-6789",
+    ] {
+        refused_nothing_journaled(&mut s, &dir, &format!("email {bad:?}"), |s| {
+            s.update_party(id, PartyField::Email(Some(bad.into())))
+        });
+    }
+
+    // `None` clears them, and the books replay to the same directory.
+    s.update_party(id, PartyField::Email(None)).unwrap();
+    s.update_party(id, PartyField::DefaultTermsAsVendor(None))
+        .unwrap();
+    s.verify().unwrap();
+    let live = s.ledger().clone();
+    drop(s);
+    for without_db in [false, true] {
+        if without_db {
+            delete_db(&dir);
+        }
+        let s = Store::open(&dir).unwrap();
+        assert!(
+            *s.ledger() == live,
+            "replay (db {}): {:?}",
+            !without_db,
+            s.ledger().differs_from(&live)
+        );
+        let got = s.ledger().get_party(id).unwrap();
+        assert_eq!(got.email, None);
+        assert_eq!(got.default_terms_as_vendor, None);
+        assert_eq!(
+            got.default_terms_as_customer.as_ref().map(|t| t.describe()),
+            Some("Net 30".to_string())
+        );
+        s.verify().unwrap();
+    }
+}
+
 /// Oracle: Store::set_party_role doc ("journaled as party.role_set") with
 /// {id, role, on}.
 #[test]