feat(core): prove the accounting laws (Kani + Lean); fix three engine gaps

The money arithmetic every invariant rests on now lives in one kernel,
ledger-core/src/kernel.rs: signing a line, totals, net, per-account
movements, reversal, normal balances, trial-balance columns, closing
lines, and the rounding plug for member splits. It is generic over a
checked `Amount` trait. The engine runs it on Decimal (validate,
movements, reverse_entry, account_balance, close_period_to, allocate,
trial_balance): there is one copy of the arithmetic, and it is the one
under proof.

Three layers, docs/verification.md maps every law to its proofs:

- Kani (src/proofs.rs): 17 harnesses prove the kernel at i64 for every
  input up to 4 lines over 3 accounts. An entry is accepted exactly
  when it is two or more positive, in-range lines whose debits equal
  credits; accepted entries net to zero; grouping by account loses
  nothing; a reversal mirrors and cancels its original; trial-balance
  columns balance iff the books net to zero; closing lines zero their
  accounts and a close balances however the net is split; the plug
  makes parts sum to the whole. No panics, no overflow. kani::cover!
  shows the proofs are not vacuous.
- Lean 4 (verify/lean): 24 headline theorems for books of any size. The
  ledger is a state machine (add account, draft, post, reverse, open,
  close), and in every reachable state the books net to zero, the trial
  balance balances (as of any date), and the accounting equation holds.
  Posting only appends ("posted is forever"), closed periods are
  frozen, a close zeroes revenue and expenses and credits exactly the net
  income, and period statements add up. Audit.lean shows standard axioms
  only, no sorry.
- Bridge (tests/kernel_bridge.rs): the Decimal and i64 kernels agree.

What the proofs found (each one missed by every test, fuzzer, and
mutant):

- The engine accepted negative line amounts; only MCP refused them. Now
  NegativeAmountLine: direction is the side's job.
- Summing lines near Decimal::MAX panicked. Lines are now capped at one
  quadrillion and ten decimal places (AmountOutOfRange), which keeps
  every realistic sum exact, and the kernel's sums are checked.
- FX conversion (foreign_amount * fx_rate) could panic the same way; it
  is now a checked multiply.
- Kani itself: 0.68 mis-models symbolic-length copy_from_slice
  (model-checking/kani#4904) and reported a reversal that doesn't net to
  zero. The counterexample, replayed natively, passes, and a 15-line
  standalone crate reproduces the bug. Harnesses avoid bulk copies, and
  a should_panic canary will flag the upstream fix.

`just prove` runs it all (Kani memory- and time-capped, fails on an
unsatisfiable cover or a non-standard Lean axiom). AGENTS.md now makes
formal coverage part of every core change.

Also, docs: GnuCash is *an* oracle, never *the* oracle (Stephen). The
spec is accounting principles, proved. Golden files are recomputed from
principles. External implementations (GnuCash, the old Sheet, QBO/Xero)
are cross-checks whose disagreements get adjudicated, never obeyed.
docs/oracle.md gains "Who is right"; AGENTS, README, architecture,
roadmap, parity, and STATUS are reworded to match.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX

plan/STATUS.md

@@ -58,6 +58,15 @@ public. Parity is 12 of 12 against the spreadsheet workflow.
   design, parity catalog (floor: 10 done), glossary, mcp-interface (incl. the
   5 asset tools), receipt-store (journal design), capability-parity
   (10 of 12 rows covered). Plan: this file + roadmap.
+- **Formal verification** (2026-10-13, `docs/verification.md`): the
+  money arithmetic moved into one generic kernel (`kernel.rs`) that the
+  engine calls. 18 Kani harnesses prove it exhaustively within bounds,
+  with covers against vacuity and a canary for a Kani soundness bug. 24
+  Lean 4 theorems prove the accounting laws for books of any size, after
+  any sequence of commands. A property test bridges `i64` and `Decimal`.
+  `just prove`. Found and fixed: negative line amounts accepted by the
+  engine, an overflow crash on huge amounts, and an overflow crash in FX
+  conversion.
 
 **In progress:** nothing — the next arcs are queued below, unstarted.
 
@@ -76,11 +85,18 @@ interface is MCP, not a cloned GUI. The first storage + MCP slice is done
 4. **Capability parity** (`docs/capability-parity.md`): 11 of 12 rows
    covered; full CPA export (xlsx/iif) remains. Then the month-long parallel
    run against the GSheet; cutover per the cutover rule.
-5. Then: oracle harness (GnuCash diff), read-only GUI on the event log,
+5. Then: oracle harness (cross-check diffs, GnuCash first), read-only GUI on the event log,
    workflow parity.
 
 ## Decisions log
 
+- 2026-10-13: Formal methods are part of the bar (Stephen: "This shit is
+  fucking GOLD"). Money arithmetic lives in `kernel.rs` with Kani
+  harnesses; accounting laws get Lean theorems; `just prove` stays green.
+  The engine now rejects negative and out-of-range line amounts (max one
+  quadrillion, ten decimal places). Every dev tool is pinned in
+  `mise.toml`. See AGENTS.md "Formal methods".
+
 - 2026-10-10: Single currency per ledger for day one (R-5). Multi-currency
   is designed-for, not built.
 - 2026-10-10: `Money` arithmetic is checked and returns `Result`; no
@@ -96,8 +112,9 @@ interface is MCP, not a cloned GUI. The first storage + MCP slice is done
   a parallel-run cutover rule. GUI drops to read-only, event-log-driven,
   phase 4.
 - 2026-10-10: Import/export targets QuickBooks formats (CSV, IIF, XLSX) —
-  "could not give a single shit about GnuCash XML." GnuCash stays the
-  *behavioral* oracle only. Receipt enforcement is server-side policy in the
+  "could not give a single shit about GnuCash XML." GnuCash stays a
+  *behavioral* cross-check only. (2026-10-13, Stephen: it is "an" oracle,
+  not "the" oracle; never trust it to be correct.) Receipt enforcement is server-side policy in the
   MCP layer (threshold + per-account overrides, typed `receipt_required`
   error, checklist in every preview); the engine stays policy-free.
 - 2026-10-10: Storage durability (Stephen). SQLite is the query engine, not

plan/roadmap.md

@@ -24,8 +24,10 @@ The primary interface is MCP, not a cloned GUI (Stephen's call, 2026-10-10).
 
 ## Phase 3 — Oracle harness (next)
 
-- `ledger-oracle`: fixture books through our engine and GnuCash headless,
-  automatic `snapshot()` diffing.
+- `ledger-oracle`: fixture books through our engine and other
+  implementations (GnuCash headless first), automatic `snapshot()`
+  diffing. Each diff is adjudicated from principles; no other program is
+  the authority.
 - Parity catalog becomes machine-readable; CI enforces the non-regression
   floor.
 - Done when: a fixture book produces byte-identical snapshots from both
@@ -82,7 +84,8 @@ The primary interface is MCP, not a cloned GUI (Stephen's call, 2026-10-10).
 - Multi-currency with FX translation.
 - Period close.
 - The goal: a self-hosted bookkeeping system with a tested claim to
-  semantic parity with GnuCash and capability parity with the old
+  proved accounting semantics (cross-checked against GnuCash and others)
+  and capability parity with the old
   GSheet+GDrive workflow — no SaaS subscription required.
 
 ## Explicitly not on the roadmap