plan: P0 notes

plan/served.md: defect 21 (found in P0: the CPA package's
general-journal.iif ignores as_of, so an as-of package includes entries
dated after it; its xlsx and csv files respect it) joins the defect
count, P3 beside defect 7, and the P10 re-run; 5.6 records that the
first company's goldens are kept privately in its own books dir
(export_cpa_package zips plus a canonical JSON form made by its
goldens/canon.py, which normalizes per-export text, with the comparison
protocol in its README), not in this public repo, by decision.
plan/STATUS.md: P0 is in final review.

Review round 3: STATUS says what is true (P0 in final review, the
mutation runs done).

Adds defect 22 (depreciation through an asset's final month plugs to
the full amount mid-month) to P3 and to the P10 re-audit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj

plan/STATUS.md

@@ -1,40 +1,37 @@
-# STATUS — 2026-10-16: "Served" planned, P0 paused mid-build
+# STATUS — 2026-10-16: "Served" planned, P0 in final review
 
-## Now: Served (plan/served.md), paused 2026-10-16
+## Now: Served (plan/served.md), P0 in final review
 
 The 2026-10-16 audit of the first company's books (62 verified findings,
 20 engine defects) and the design discussion that followed produced
 `plan/served.md`: the books become a server that owns its data, agents
 reach them only through the MCP from anywhere, settings and conventions
 move into the journal, no scaffold. Phases P0-P10; the owner's decisions
-of 2026-10-16 are at the top of the plan and bind every phase.
+of 2026-10-16 are at the top of the plan and bind every phase. A 21st
+defect turned up in P0 (the CPA package's IIF ignores `as_of`; P3).
 
-**Paused** on 2026-10-16 to save the owner's weekly usage credits. Resume
-lean: finish work solo or with one reviewer; big multi-agent fan-outs
-only when the owner asks.
+Resume lean: finish work solo or with one reviewer; big multi-agent
+fan-outs only when the owner asks.
 
-**P0 (guard rails) state** — three jj workspaces beside this checkout,
-none merged into `main` (main = the plan commit only):
-
-| Workspace | Change | State |
-|---|---|---|
-| `../wanderbooks-p0-misc` | `qntm` "P0: pin dev tools, honest transports doc, tools-only template" | done, committed, gates run for ledger-cli |
-| `../wanderbooks-p0-mcp` | `nuxl` WIP (~1,600 lines, 26 files) | stopped mid-build: import_local_file lockdown (roots = downloads + system temp; refuse data dir, books dir, vault, key dir, symlink escapes), tool annotations on all tools, short connect text + `books.handbook` tool/resources, bare `books://digest`, tokio mutex + spawn_blocking. Unknown how far each item got; not gated |
-| `../wanderbooks-p0-store` | `vnqq` WIP (~1,100 lines, 15 files) | stopped mid-build: `StoreError::NewerJournal`, `journal.format_set`, GUI/Snapshot distinction. Not gated |
-
-**To resume P0:** in each WIP workspace, diff against main, finish the
-items listed under "### P0" in `plan/served.md` (scope, tests, acceptance),
-run `just check` there; then stack misc -> store -> mcp on `main` in the
-default workspace, run `just check` and `cargo mutants --in-diff` on the
-P0 diff (output under ~/.cache/wanderbooks/mutants), one adversarial
-review, push (origin + github), `jj workspace forget` the three and
-delete their directories. After P0 lands, the owner reconnects the MCP
-(`/mcp` or a new session) so the new connect text loads.
+**P0 (guard rails) state:** built and gated, stacked on `main` in the
+default workspace (not merged, not pushed), through two review rounds:
+`qntm` (pins, transports doc, tools-only template), `vnqq` (the store's
+format gate: newer is not corrupt; the envelope and its hash frozen
+across formats; no repair of newer books), `nuxl` (connect text and
+handbook, annotations, the import roots' lockdown, fail closed, no file
+with a full TIN filed into the books), `rros` (docs), and this plan note.
+`just check` passes on the stack, and `cargo mutants --in-diff` has run
+on the P0 diff, every round (counts in `docs/testing.md`; output under
+~/.cache/wanderbooks/mutants). Left for P0: the owner's final review,
+then move `main` and push (origin + GitHub); the three P0 workspaces are
+already gone. After P0 lands, the owner reconnects
+the MCP (`/mcp` or a new session) so the new connect text loads.
 
 **Before-snapshots for later phases:** the first company's reports as of
 2026-10-11 and 2026-10-16 (journal head `d1ccd2fd…`, 355 events) are
 saved in that books dir under `goldens/p0-2026-10-16/` (exported through
-the MCP, no TINs). P1+ must reproduce them except where the P3 change log
+the MCP, no TINs), privately, by decision, never in this public repo
+(plan 5.6). P1+ must reproduce them except where the P3 change log
 adjudicates a difference (cash flow, defect 1).
 
 **Then:** P1 (journal-native settings and conventions), P2 (serve locally,

plan/served.md

@@ -50,7 +50,7 @@ Paths are relative to `/home/swaits/Code/wanderbooks/crates/` unless they are ab
 
 **How private is it?** Hidden, not locked. An agent cannot stumble into the books. Because the server runs as you, though, an agent that deliberately went hunting could find them, and the books say this plainly wherever privacy is reported. If you ever want a hard wall, run the same server on another machine you own. This plan includes that recipe, and the same setup is how claude.ai on the web reaches your books.
 
-**Along the way**, the 20 problems found in the 2026-10-16 audit get fixed. The finish line is a full re-audit of Wanderland, done only through the books' own tools, in which every receipt and every entry is checked and signed off.
+**Along the way**, the 20 problems found in the 2026-10-16 audit get fixed, and a 21st found while capturing the goldens in P0. The finish line is a full re-audit of Wanderland, done only through the books' own tools, in which every receipt and every entry is checked and signed off.
 
 ---
 
@@ -545,7 +545,7 @@ The `WANDERBOOKS_TOML` template (`ledger-cli/src/main.rs:237-347`) becomes the e
 
 | When | Step | Acceptance |
 |---|---|---|
-| P0 | Install new binaries (still stdio). Capture **golden JSON** of TB, P&L, BS, CF, members' equity, GL, journal, vendor_1099, parties, assets, schedules and digest, as of 2026-10-11, every month-end, FY-to-date and today, through the old binary over MCP. Only checksums plus a redacted fixture are kept in the repo. | Goldens stored |
+| P0 | Install new binaries (still stdio). Capture **golden JSON** of TB, P&L, BS, CF, members' equity, GL, journal, vendor_1099, parties, assets, schedules and digest, as of 2026-10-11, every month-end, FY-to-date and today, through the old binary over MCP. By decision (2026-10-16) the first company's goldens are kept privately in its own books dir, not in this public repo: `export_cpa_package` zips plus a canonical JSON form made by that dir's `goldens/canon.py` (which normalizes the text each export varies, such as its timestamp), with the comparison protocol in its README. | Goldens stored |
 | P1 | The agent reads `/home/swaits/Documents/Wanderland-Books/wanderbooks.toml` (and `books-data/config.json` only by asking Stephen to state its values, since it sits under `books-data/`) and calls `import_settings`. Expected diff:<br>• the 15 `[company]` keys; EIN as identity<br>• members 50/50 → 3000/3001 with `files_jointly_with`<br>• `accounting_basis=accrual`, `policy.evidence.threshold=0.00` (Stephen, 2026-10-12)<br>• `cash_accounts=["1000"]`, `financing_accounts=["2100"]`; the citation is corrected to ASC 230-10-45-14(b)<br>• `parties=require` (2026-10-15), `timezone=America/Denver` (D-13, decided)<br>• `policy.approval_rules` stays `off`<br><br>Conventions are proposed in one batch preview from `AGENTS.md:74-227`:<br>• 9 posting templates: joint contribution as two entries; expense from joint personal funds → 2100; expense from Bluevine; household reimbursement (`Dr 2100 / Cr 1000`) with a `note` that Stephen gives the go-ahead before money moves, recorded with its source and not an enforced gate; 50/50 distribution; revenue 4000; card 2050 expense and payment; cash entries dated by bank posting date<br>• policies: numbering, one file per receipt (PDF preferred), email as PDF, capitalization (`policy.capitalization` plus decisions 2026-10-11 and 2026-10-16)<br>• `close_step`: "ask Stephen whether a member paid anything personally"<br>• `calendar`: Utah annual report around Oct 4, renewal fee to taxes & licenses<br>• memory-only rules become conventions: post when ready; decisions to Stephen go one question at a time; TINs only in the vault<br><br>Decisions: one file per receipt (10-11), threshold (10-12), cutover with Sheet frozen as of 10-11 and reference attachment 37 (10-14), renumber 6100→6050 and card at 2050 (10-14), TINs in vault (10-15); light governance, meaning no consent paperwork, spending limits, signed memos or amendments for the two-member LLC, with decisions recorded with their source (10-16); local isolation "you, hidden away", the viewer reading the disk directly, no added permission prompts, and self-host now with hosting later (10-16).<br><br>Open items:<br>• IRS name control "WALN" discrepancy; letter = attachment 70, mailing pending<br>• deferred revenue to be raised with the CPA before the first subscription<br><br>Per-entry notes: entries 4 and 5 dated Oct 7 to match the Sheet. | Every golden report and export is byte-identical before and after the import. GUI shows Wanderland correctly with `wanderbooks.toml` renamed away. No `approval_rule` convention is created, and every daily-flow post still succeeds without an approval |
 | P2 (pre-cutover) | Run `verify-sheet` and `drive-manifest verify` a final time and file their outputs as `workpaper` documents. Recapture goldens. | Both pass |
 | P2 cutover (about 10 min) | 1. Ask Stephen the three cutover questions (section 10.3: Q-1 backups, Q-2 `company/` records, Q-3 old copies), one at a time, in plain English.<br>2. Quit the agent sessions and the GUI.<br>3. `wanderbooks service install`, with no sudo: it writes the systemd `--user` socket and service units, creates the data root (0700), and asks for the owner passphrase.<br>4. `wanderbooks books adopt /home/swaits/Documents/Wanderland-Books/books-data --id wanderland` (archive target from Q-1; old copies moved per Q-3).<br>5. `wanderbooks connect claude-code --book wanderland` (removes the old stdio registration made by `just mcp-add`, adds the HTTP registration with `headersHelper`).<br>6. `wanderbooks connect codex --book wanderland`.<br>7. `wanderbooks gui wanderland` (offers login autostart).<br>8. Remove `justfile`, `.claude/settings.json` hook, `.codex/hooks.json`, `scripts/` (archived under the data root's `legacy/`); `AGENTS.md`/`CLAUDE.md` become a 3-line pointer ("connect the wanderbooks MCP; call books.start").<br>9. Per Q-2, file the `company/` records as documents, or leave them as local files. | `books.verify` over MCP equals H. Goldens byte-equal. `books.start` works from Claude Code started in `~` and in `/tmp/empty`, and reports `isolation: "same_user (advisory)"`. No connect text, tool text, handbook section or result in a recorded cutover session names the data root. No step asked for sudo. If Q-3 is "move": the project folder holds no journal, blobs, vault or git history containing them. Viewer updates within 1 s. **Rollback (nothing posted on the server):** stop the user service, move `legacy/wanderland-<date>/` back to the project folder (or use the untouched source if Q-3 was "no"), and re-register the P1 binary's stdio server as before cutover. **Rollback (entries posted):** `wanderbooks books export-legacy wanderland` writes a data dir with the same head check, then the same re-registration |
@@ -783,7 +783,7 @@ Wanderland keeps working between phases.
 - Two concurrent agents post 12 entries each with no lost writes.
 - Viewer updates within 1 s.
 
-### P3: Engine correctness (defects 1, 7, 8, 9, 11, 12, 13, 14, 15, 16, 17, 18)
+### P3: Engine correctness (defects 1, 7, 21, 8, 9, 11, 12, 13, 14, 15, 16, 17, 18, 22)
 
 **Defect 1, cash flow** (`ledger-core/src/reports.rs:1231-1560`):
 - **Partition.** Every non-cash balance-sheet account belongs to exactly one section: investing (fixed-asset cost and accumulated depreciation, plus `investing_accounts`), financing (equity, plus `financing_accounts`), or operating (all others, including P&L).
@@ -799,6 +799,10 @@ Wanderland keeps working between phases.
 
 **Defect 7, IIF** (`ledger-import/src/iif.rs:169,243`): DOCNUM = entry_id. Output encoded in Windows-1252; characters outside it are transliterated (deunicode) and listed in `warnings`.
 
+**Defect 21, CPA package IIF and as_of** (found in P0, 2026-10-16): the CPA package's `general-journal.iif` ignores `as_of` (an as-of package includes entries dated after it); its xlsx and csv files respect it. The IIF export takes the same `as_of`, and a test pins every file in an as-of package to it.
+
+**Defect 22, depreciation through an asset's final month** (found in P0 review round 4, 2026-10-17): the depreciation schedule plugs to the full depreciable amount whenever the date it is computed through falls in the asset's final month, even mid-month. A disposed asset's schedule therefore shows full depreciation in its disposal month, and mid-final-month figures are overstated. Resolve from the standard (straight-line, partial months prorated by days, as the rest of the schedule already does), then adjudicate the changed figures in the P3 change log. Related, found in the same round and fixed in P0: the final-month true-up compared the month with chrono's `%Y`, so assets whose life ran past 9999 (or before year 0) never trued up. Assets whose life runs past 9999 also can't post months after 9999-12 (periods are bounded to years 1-9999); decide in P3 whether to refuse such lives at registration. Also noted: the viewer recomputes a very long-life asset's whole schedule every frame (slow; pre-existing).
+
 **Defect 8, tax categories:** `add_account` warns on P&L accounts without a tax category. Needs attention flags all P&L accounts regardless of activity. `policy.require_tax_category` makes it a refusal.
 
 **Defect 9, schedules:**
@@ -1016,7 +1020,7 @@ Run from clients that hold only a URL and a credential: Claude Code started in `
 1. `books.audit scope=full through=<month-end>` and `scope=cpa_handoff`. Every finding is fixed through journaled corrections: reversal drafts with evidence, annotations, decisions. Legacy reversals posted without their own evidence inherit the original's with `inherit_evidence` (D-12, decided).
 2. Every receipt is attested from `get_receipt` text plus page image by a pair at the bar: high reasoning effort, adversarial, at least 2 independent verifier agents (D-9, decided). No base64 enters context.
 3. `review_entry` for every posted entry; `attest_period` monthly since formation and `cpa_handoff` annually.
-4. Each of the 20 defect reproductions from 2026-10-16 is re-run, and each shows fixed.
+4. Each of the 22 defect reproductions (20 from the 2026-10-16 audit, and defects 21 and 22 from P0) is re-run, and each shows fixed.
 5. `compare_reference` against the Sheet as of 2026-10-11 shows 0 differences. `check_inventory` against the Drive listing shows 0 gaps.
 6. CPA package: no TINs through the agent; with TINs through the human link.
 7. The head is handed to Stephen and verified against a fresh `fetch` with `verify-archive --expect-head`.