feat(deploy): self-host recipe, the enforced isolation flag, and the tunnel's door (P9a)

The books can live on a machine of the owner's own (plan 3.8, 8.2 P9a,
D-51). Three things make that honest instead of nominal:

- `--isolation same_user|enforced` sets `server::Isolation`, carried
  through `Served` and `BooksServer` to `books.start`. Locally the books
  stay `same_user (advisory)`; under the self-host unit the server is told
  `enforced` and reports `service_user (enforced)`. The server never
  guesses, and the literal it used to report is gone.
- `--http [ADDR]` binds the same MCP router on loopback (default
  127.0.0.1:7411) beside the Unix sockets, before the ready line, for the
  TLS proxy or tunnel in front of the server. It is the same bearer door
  and the same graceful close; a failed bind is reported and is not fatal
  (3.9). `serve` carries both flags through the host, so the system unit
  can ask for them once.

`deploy/wanderbooks-server.service` is the unit: a dedicated account, a
0700 data root, `ProtectSystem=strict`, no seccomp or Landlock (D-32), and
loopback-only networking. `deploy/README.md` is the recipe: install, setup,
move the books by `books adopt` with its head check (D-31: a copied book
is the transport), mint a bearer token, put Caddy or Tailscale Funnel in
front of the loopback door, and point Claude Code and Codex at it.

The two-account CI job (`.github/workflows/two-user.yml`) makes the
deployment and runs `crates/ledger-cli/tests/two_user.rs` as another
account: `agent_uid_cannot_read_tenant` proves the tenant root and its
journal are refused, then reads, writes, uploads, files, exports and
verifies over HTTP with the bearer (in a second book, so the moved books'
head is not advanced); `self_host_adopt_same_head` compares the moved
books' head and event count with the source clone's.
`isolation_label_is_enforced_under_the_unit` runs everywhere, including
the unit-file read that keeps the recipe from drifting.

Accounting reason for the shape: nothing here changes an entry, a report
or a figure. It changes who can reach them: the move is lossless and
verifiable at the head, and the boundary is the operating system's, not a
promise in our text. No journal code, kernel function, Kani harness or
Lean step is touched, so `just prove` is not required.

No go-ahead needed: no new journal feature or event; the live books are
unaffected.

crates/ledger-host/src/commands.rs

@@ -231,16 +231,44 @@ pub fn serve(
     args: impl IntoIterator<Item = String>,
 ) -> Result<(), Box<dyn std::error::Error>> {
     let mut common = Common::default();
-    let mut args = args.into_iter();
+    let mut server_flags: Vec<String> = Vec::new();
+    let mut args = args.into_iter().peekable();
     while let Some(arg) = args.next() {
         if common.take(&arg, &mut args)? {
             continue;
         }
         match arg.as_str() {
+            // What this server is told (P9a): passed through the host.
+            "--isolation" => {
+                let level = args
+                    .next()
+                    .ok_or("--isolation needs same_user or enforced")?;
+                if !matches!(
+                    level.as_str(),
+                    "same_user" | "advisory" | "service_user" | "enforced"
+                ) {
+                    eprintln!("error: --isolation takes same_user or enforced, not {level:?}");
+                    return Err(exit(2));
+                }
+                server_flags.push(arg);
+                server_flags.push(level);
+            }
+            "--http" => {
+                server_flags.push(arg);
+                if let Some(v) = args.peek()
+                    && !v.starts_with('-')
+                {
+                    server_flags.push(args.next().unwrap_or_default());
+                }
+            }
             "--help" | "-h" => {
-                eprintln!("usage: {prog}");
+                eprintln!("usage: {prog} [--root DIR] [--isolation LEVEL] [--http [ADDR]]");
                 eprintln!("  Opens the books and holds them open until Ctrl-C. They close 10 s");
                 eprintln!("  after nothing else (the app, an agent session) holds them.");
+                eprintln!("  --isolation same_user | enforced: how books.start says these books");
+                eprintln!("    are kept from agents (enforced: the owner's own machine, P9a).");
+                eprintln!("  --http [ADDR]: also serve the MCP door on 127.0.0.1:7411 (or ADDR),");
+                eprintln!("    for a TLS proxy or a tunnel in front of it.");
                 return Ok(());
             }
             other => {
@@ -259,7 +287,8 @@ pub fn serve(
             common.knobs,
             Kind::Serve,
             None,
-        )?;
+        )?
+        .starting_with(server_flags);
         // Ctrl-C, SIGTERM and SIGHUP are heard from the start, whatever
         // serve is doing (opening, waiting to try again): none is missed.
         let stop = std::sync::Arc::new(tokio::sync::Notify::new());

crates/ledger-host/src/host.rs

@@ -244,16 +244,32 @@ struct Args {
     /// server finds the root itself, and no command line names it.
     root: Option<PathBuf>,
     knobs: Knobs,
+    /// Flags the server is started with (P9a): `--isolation`, `--http`.
+    server_flags: Vec<String>,
 }
 
 fn parse_args(prog: &str, args: impl IntoIterator<Item = String>) -> Result<Option<Args>, String> {
     let mut root = None;
     let mut knobs = Knobs::default();
-    let mut args = args.into_iter();
+    let mut server_flags: Vec<String> = Vec::new();
+    let mut args = args.into_iter().peekable();
     while let Some(arg) = args.next() {
         match arg.as_str() {
             "--root" => root = Some(PathBuf::from(args.next().ok_or("--root needs a folder")?)),
             FLAG => knobs = Knobs::parse(&args.next().ok_or("--test-knobs needs a value")?)?,
+            // Passed through to the server (P9a).
+            "--isolation" => {
+                server_flags.push(arg);
+                server_flags.push(args.next().ok_or("--isolation needs a level")?);
+            }
+            "--http" => {
+                server_flags.push(arg);
+                if let Some(v) = args.peek()
+                    && !v.starts_with('-')
+                {
+                    server_flags.push(args.next().unwrap_or_default());
+                }
+            }
             "--help" | "-h" => {
                 eprintln!("usage: {prog} [--root DIR]");
                 eprintln!("  Holds the books open while anything holds a lease on it; started by");
@@ -263,7 +279,11 @@ fn parse_args(prog: &str, args: impl IntoIterator<Item = String>) -> Result<Opti
             other => return Err(format!("unknown argument: {other}")),
         }
     }
-    Ok(Some(Args { root, knobs }))
+    Ok(Some(Args {
+        root,
+        knobs,
+        server_flags,
+    }))
 }
 
 /// `wanderbooks host`.
@@ -395,6 +415,8 @@ struct Host {
     root: Root,
     run: PathBuf,
     knobs: Knobs,
+    /// Flags the server is started with (P9a).
+    server_flags: Vec<String>,
     leases: BTreeMap<u64, Held>,
     next_lease: u64,
     ready: bool,
@@ -417,6 +439,7 @@ impl Host {
             root,
             run,
             knobs: args.knobs,
+            server_flags: args.server_flags,
             leases: BTreeMap::new(),
             next_lease: 1,
             ready: false,
@@ -655,6 +678,8 @@ impl Host {
         if self.explicit_root {
             command.arg("--root").arg(self.root.path());
         }
+        // What `serve` was told, for the server (P9a).
+        command.args(&self.server_flags);
         let d = Knobs::default();
         for (flag, now, default) in [
             ("--backup-quiet", self.knobs.backup_quiet, d.backup_quiet),

crates/ledger-host/src/opener.rs

@@ -100,6 +100,9 @@ pub struct Opener {
     opened_at: Option<std::time::Instant>,
     /// Whether this holder has held a lease (INVARIANT 5).
     has_held: bool,
+    /// Flags the server this opener starts is started with (P9a):
+    /// `--isolation` and `--http`. Empty for every ordinary holder.
+    server_flags: Vec<String>,
 }
 
 /// A held lease: the books stay open while it lives.
@@ -146,9 +149,20 @@ impl Opener {
             failures: 0,
             opened_at: None,
             has_held: false,
+            server_flags: Vec::new(),
         })
     }
 
+    /// Start the server this opener brings up with these flags (P9a:
+    /// `--isolation`, `--http`). Only `serve` uses it: on the owner's own
+    /// machine it is the one holder, so the host it starts is the server's
+    /// only one. A host already running was started with other flags, and
+    /// this one has no way to change it.
+    pub fn starting_with(mut self, flags: Vec<String>) -> Self {
+        self.server_flags = flags;
+        self
+    }
+
     /// The timings in force.
     pub fn knobs(&self) -> Knobs {
         self.knobs
@@ -256,9 +270,12 @@ impl Opener {
     async fn start(&self) -> Result<(), String> {
         let root = self.root.clone();
         let knobs = self.knobs;
-        tokio::task::spawn_blocking(move || crate::start::start_host(root.as_deref(), &knobs))
-            .await
-            .map_err(|e| e.to_string())?
+        let flags = self.server_flags.clone();
+        tokio::task::spawn_blocking(move || {
+            crate::start::start_host(root.as_deref(), &knobs, &flags)
+        })
+        .await
+        .map_err(|e| e.to_string())?
     }
 
     /// Say hello on a connection and read the host's first word.
@@ -457,6 +474,7 @@ mod tests {
             failures: 0,
             opened_at: None,
             has_held: false,
+            server_flags: Vec::new(),
         };
         for _ in 0..MAX_TRIES {
             o.failed().await.unwrap();

crates/ledger-host/src/start.rs

@@ -174,8 +174,12 @@ fn systemd_run() -> Option<&'static str> {
 }
 
 /// Start a host for the root (`root`, else the one the host finds
-/// itself), with these knobs (INVARIANTS 1-5).
-pub fn start_host(root: Option<&Path>, knobs: &Knobs) -> Result<(), String> {
+/// itself), with these knobs and these server flags (INVARIANTS 1-5).
+pub fn start_host(
+    root: Option<&Path>,
+    knobs: &Knobs,
+    server_flags: &[String],
+) -> Result<(), String> {
     let found = ledger_store::root::Root::find(root).map_err(|e| e.to_string())?;
     let run = found.run_dir().map_err(|e| e.to_string())?;
     let home = ledger_store::root::account_home().map_err(|e| e.to_string())?;
@@ -187,6 +191,9 @@ pub fn start_host(root: Option<&Path>, knobs: &Knobs) -> Result<(), String> {
         args.push(found.path().as_os_str().to_os_string());
     }
     args.extend(knobs.args().into_iter().map(Into::into));
+    // What the server this host starts is told (P9a): the same flags
+    // `serve` was given.
+    args.extend(server_flags.iter().map(Into::into));
     let log = || {
         let path = run.join(HOST_LOG);
         // A large log is moved aside first (to `.1`), never from under a