docs(arap): B-41, the bookspec examples, and the four registers (P4b S7)

rules.md B-41 states the write-off: the direct method the owner chose
(A-5), Dr 6990 / Cr 1200 with the receivable tagged, at most what is
owed and at most the least owed from that day on (a partial write-off as
§1.166-3(a) allows), refused on cash-basis books (§1.166-1(e)), its
evidence filed in the same call (§1.166-2(a)); bills are never written
off (ASC 405-20-40-1); and a recovery is not a new movement (D-49): the
same year, reverse the write-off and record the payment; a later year, a
plain entry to a bad-debt-recoveries revenue account, the invoice staying
written off (IRC §111).

bookspec states B-41 for the first time and gives B-38 its example: two
new examples, bad-debt-direct-write-off (two partial write-offs of one
invoice, the balances and the trial balance worked by hand) and
arap-hand-control-posting-refused (a hand line an earlier version wrote
replays, the same line written today is refused). The example schema
gains the dated write_off event, lets a refused entry say so (an entry
posts whole or not at all; older and refused never combine), and its
refusal vocabulary gains untagged_control_line, B-38's control guard.

The registers: docs/architecture.md names the new tool group;
docs/receipt-store.md lists invoice.written_off and what replay does with
it; docs/parity.md records the slice (no row changes status, the floor
stands); docs/testing.md records every test and what P12 must mutate;
docs/verification.md the two Lean theorems and what they cover.

No figure moves: no golden file changed.

docs/verification.md

@@ -504,6 +504,35 @@ come from the kernel:
       No Lean model: these are two arithmetic laws, not a new `Ledger`
       command (S4.1 adds fields to the existing document commands).
 
+### Bad debts (P4b S7)
+
+A write-off (rules.md B-41) is `Ledger::write_off`: a new command, so a new
+Lean step, and no new kernel function (its two lines are one debit and one
+credit, and the bounds are the existing date-sum's).
+
+34. **A write-off of at most what is owed leaves nothing owed below
+    zero.** The step posts the document's control line credited (tagged
+    with it, so it is the same sum B-38 fixed) and the amount of
+    bad-debt expense debited (untagged, off the control accounts).
+    `through_append` reads the write-off's own two lines through the day
+    separately; `docSum_writeOffLines` gives the control line's −amount;
+    `writeOff_within_bounds` then follows by arithmetic from the command's
+    own premise (the amount is at most the date-sum through the day).
+    `Step.writeOff_unattached` shows the step moves nothing unattached, so
+    `control_agrees` and `Reachable.control_is_documents` hold for it with
+    no new proof. A reversal re-instates: the same `reverse_twice` that
+    covers payments (`Step.reverse` mirrors every tagged line).
+    - Lean `Documents.Step.writeOff`, `Documents.Step.writeOff_unattached`,
+      `Documents.through_append`, `Documents.docSum_writeOffLines`,
+      `Documents.writeOff_within_bounds` (in `Audit.lean`) · tests
+      `half_paid_rest_written_off_is_written_off`,
+      `write_off_above_outstanding_refused`,
+      `write_off_then_recovery_same_year`, and the store's
+      `write_off_replays_and_projects` (live, replay and snapshot agree).
+      The model's limits are the documents model's (one `Nat` id space,
+      books built from empty); the cash-basis refusal is a policy on the
+      books' settings, not arithmetic, and is tested, not modelled.
+
 ## What the proofs found
 
 The engine already had 190+ tests, property tests, mutation testing,
@@ -592,7 +621,7 @@ Be precise about the claims:
   `tests/properties.rs` (trial balance, balance sheet, reversals,
   immutability) and the golden files.
 - **Out of scope:** currency (the ledger is single-currency, enforced
-  structurally), A/R and A/P documents, payroll, the calendar walk around
+  structurally), payroll, the calendar walk around
   the proration kernel (`calendar::month_parts`, `assets::depreciation_schedule`,
   `schedules::daily_plan`: property tests, `tests/properties.rs`, P3), and
   persistence (the journal store's hash chain is tested in `ledger-store`).