Control roles in the journal (books.assign_role, books.roles); the MCP reloads wanderbooks.toml on change and reports settings problems (books.settings, digest); new writes a full commented wanderbooks.toml

- core: ControlAccount keys, Ledger::assign_role/check_assign_role/role_account (rules.md B-23): one account per role, of the role's type, balance sheet roles move only when empty; invoices, bills, payroll, remittance, and closes post to the assigned account; an assigned role frees its default code for renumbering
- store: role.assigned journaled and replayed (strict account_id)
- mcp: settings.rs reloads by content at the start of each request, keeps the last good settings on a broken edit; books.settings with chart problems; digest settings_problems; instructions say when to edit the toml
- viewer: journal text for role.assigned
- cli: full example wanderbooks.toml, tested to load with every example uncommented
- tests: spec_roles.rs (25, spec-blind), store roles.rs (6), MCP reload/problems/roles, settings unit tests

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX

docs/spec/rules.md

@@ -420,3 +420,29 @@ taxable years beginning on or after January 1, 2016. The 12-month rule:
 §1.263(a)-4(f)(1). The election is made yearly on the return.
 
 **Enforced:** bookkeeper policy (books' AGENTS.md), not the engine.
+
+## B-23 Control roles: one account each, of the right kind, moved only when empty
+
+**Status:** CONVENTION (a control account agrees with the records it
+controls); DECISIONS (Stephen, 2026-10-13 and 2026-10-15)
+
+Invoices, bills, payroll, and closes post to accounts the engine picks by
+role: receivables, revenue, payables, general expense, retained earnings,
+salary and payroll tax expense, and five payroll withholdings. A role uses
+its default code (1200, 4000, 2000, 6999, 3999, 6100, 6110, 2110–2150)
+until the human assigns it one of the chart's own accounts; the assignment
+is journaled, so replay never depends on a setting outside the journal
+(DECISION, 2026-10-15). A role's account is postable and of the role's
+type (B-4), and the engine refuses one that isn't rather than renumber
+the chart (DECISION, 2026-10-13). No account fills two roles. A
+receivables, payables, withholding, or retained earnings account must keep
+agreeing with what it controls (open invoices, open bills, taxes withheld,
+closed earnings): such a role moves only when its account holds no
+balance, so the bookkeeper first moves the balance with an entry, which
+the journal shows. Revenue and expense roles move at any time; earlier
+postings stay where they are.
+
+**Enforced:** `Ledger::check_controls`, `Ledger::assign_role` /
+`check_assign_role`, `Ledger::check_renumber_account` (an assigned role
+frees its code). **Checked:** `ledger-core` `tests/spec_roles.rs`;
+`ledger-store` replay of `role.assigned`.