merge: P4b S7, bad debts (branch S7, 4b4fecb9)

The fourth of the paused branches: Ledger::write_off and the bad_debts
control role, invoice.written_off with its evidence filed in the same
store call, books.write_off_invoice, the write-off on the timeline and
in Needs attention, Lean writeOff_within_bounds, rules.md B-41 and the
bookspec examples. Twenty-eight files conflicted with the S4.4, S5 and
S6 merges; resolved as plan 8.0.2 says, keeping both sides' appends with
their seams restored, and: the scope table at 125; S7's law numbered 37;
B-41 placed before B-42; the handbook's step 4 and recovery procedures
folded into the one invoices-and-bills section; S7's wire tests in their
own module with the confirm S4.4's contract needs; S7's copy of the
payment steps dropped (S6 replaced them with Ledger::settle) and its
write-off journaled through S6's journal_auto_lines; in the old-books
fixture S7's hand-written write-off moved to a second invoice, since
S6's hand-written payment settles invoice 1 in full.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp

docs/receipt-store.md

@@ -62,6 +62,9 @@ apply is safe — on startup the applier replays every journal line with
   send: a document's record, never a ledger line or a figure; P4b S5)
   (plus the A/R, A/P, asset, period, payroll, and class events listed on
   `JournalLine`).
+  `invoice.written_off`, `bill.created`, `receipt.attached`, `receipt.linked`, `receipt.unlinked`,
+  `document.filed`, `attachment.withdrawn` (plus the A/R, A/P, asset,
+  period, payroll, and class events listed on `JournalLine`).
 - `payload`: the full domain facts (account fields, entry with lines, blob
   sha, ...). Everything the applier needs; nothing it must look up elsewhere.
   An `invoice.created` or `bill.created` written after the `documents_v2`
@@ -76,7 +79,13 @@ apply is safe — on startup the applier replays every journal line with
   entry exists): it is a `receipt.attached` on the invoice's own entry
   (`INV-0007.pdf`, `application/pdf`, "Issued invoice"), its SHA-256 the
   `blob_sha`, linked to the invoice with `attachment.linked` and found
-  through that link (plan 8.3.11).
+  through that link (plan 8.3.11). An `invoice.written_off` (plan 8.3.6,
+  P4b S7) carries `{invoice_id, entry_id, date, amount, reason}`; replay
+  tags the entry's receivables line `WriteOff`, and the projection keeps
+  no written-off figure either: it is the tagged lines' sum (rules.md
+  B-38, B-41). Its evidence of worthlessness rides beside it, as a
+  `receipt.attached` on the write-off's entry and an `attachment.linked`
+  to the invoice, filed in the same call.
 - `prev`: hex SHA-256 of the previous line's canonical JSON (keys sorted, no
   whitespace). The genesis line uses `"prev": "000...0"` (64 zeros).