merge: P6, the evidence pipeline (branch P6, checkpoint ce366408)

The last of the paused branches, from its "not for merge" checkpoint:
extraction in ledger-import (text, pages, page images; capped, caught),
journaled as attachment.text_extracted; dedup by hash with
books.find_attachment and books.consolidate_duplicates; annotations and
books.set_entry_settles; the company record categories; the two fuzz
targets; feature attachment_text. Nineteen files conflicted with the
four P4b merges, resolved as plan 8.0.2 says: P6 retakes schema 18 (it
had taken 16, which S4.3 holds; S5 holds 17); the tool table is 129 and
the destructive count 31; both sides' appends kept with their seams
restored; one B-27 paragraph naming every feature; in the old-books
fixture P6's hand-written reimbursement is entry 7 (its ids collided
with S4.3's invoice); the replay fuzzer's list gains S7's
invoice.written_off; S4.3's issued-PDF test expects the extraction
record P6 journals right after a filing.

One integration defect between S7 and P6, found by the arap property
test and fixed here: under P6's dedup, a write-off whose evidence bytes
were filed already (the same collection letter for a second write-off of
the same invoice) was refused only after its entry had been journaled,
at the final link to the invoice ("already linked"). The write-off now
resolves the dedup before anything is journaled and keeps a link the
record already has to the invoice instead of refusing it; an explicit
existing_attachment_id already on an entry is still refused (S7's
one-receipt-once rule). P6's gate never ran before the pause; it runs on
main after this merge, and its ledger-store -> ledger-import dependency
is the open review point (plan 8.0.1).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp

crates/ledger-host/src/commands.rs

@@ -477,6 +477,7 @@ fn books_usage(prog: &str) {
     eprintln!("       {prog} restore BACKUP [--id ID] [--replace] [--yes]");
     eprintln!("       {prog} back-up ID [--new-disk]");
     eprintln!("       {prog} upgrade ID");
+    eprintln!("       {prog} extract BOOK ATTACHMENT");
     eprintln!(
         "       {prog} put-aside ID DATA-DIR [--vault DIR --vault-key FILE] [PATH...] [--yes]"
     );
@@ -492,6 +493,9 @@ fn books_usage(prog: &str) {
     eprintln!(
         "  upgrade give the go-ahead, with the owner passphrase, for books an older wanderbooks wrote to move to this version's journal format (a verified backup with the vault and keys first)"
     );
+    eprintln!(
+        "  extract read one attachment's text (a PDF, XLSX or text file) and journal it, one at a time; books an older version filed are read this way after an upgrade"
+    );
     eprintln!(
         "  put-aside move the old copies of adopted books (their data folder, their vault and its key, and other paths given: settings file, git history) whole into the legacy folder, once the books hold everything they do, byte for byte; nothing is deleted"
     );
@@ -580,6 +584,19 @@ pub fn books(
         }
         ["restore", source] => return restore(&common, source, id, replace, yes),
         ["upgrade", book] => return upgrade(&common, book),
+        ["extract", book, attachment] => {
+            let attachment_id: u64 = attachment.parse().map_err(|_| {
+                eprintln!("error: extract takes an attachment id: {attachment}");
+                exit(2)
+            })?;
+            with_server(
+                &common,
+                Request::Extract {
+                    id: (*book).to_string(),
+                    attachment_id,
+                },
+            )
+        }
         ["put-aside", book, source, also @ ..] => {
             let also: Vec<PathBuf> = also.iter().map(PathBuf::from).collect();
             let old = ledger_store::root::OldCopies {
@@ -634,6 +651,25 @@ pub fn books(
             );
             Err(exit(1))
         }
+        Ok(Response::Extracted {
+            attachment_id,
+            status,
+            pages,
+            text_sha256,
+        }) => {
+            match (&text_sha256, status.as_str()) {
+                (Some(sha), "ok") => {
+                    println!("Read attachment {attachment_id}: {pages} page(s), text {sha}.")
+                }
+                (_, "none") => println!(
+                    "Read attachment {attachment_id}: no text to read ({pages} page(s)); view its pages as pictures."
+                ),
+                _ => println!(
+                    "Read attachment {attachment_id}: the reader failed ({pages} page(s)); a human must read it."
+                ),
+            }
+            Ok(())
+        }
         Ok(Response::Refused(why)) | Err(why) => {
             eprintln!("error: {why}");
             Err(exit(1))