config, mcp, gui: specs from sources, spec-blind suites, and the bugs they found

ledger-config: parse gets a sourced spec. A fiscal year starts on the
first of a month (IRS Pub. 538); tax_classification is read by whole
words (Treas. Reg. 301.7701-3, Schedule C instructions; "business corp"
no longer reads as an S corp, "corporation or S corporation" is refused);
duplicate or blank members and shared capital accounts are refused; a
negative or non-grammatical receipt threshold is refused; codes trimmed.
tests/spec_config.rs (65 spec-blind tests, 14 properties), fuzz target
fuzz_config_parse (weekly). Mutation: 55 of 55 viable caught (from 25/38).

The receipt policy moves to ledger-config, with one loader
(effective_receipt_policy) and one decimal grammar, so the server and
the viewer enforce and show the same rule (the viewer had its own: only
expense-like debits, a silent $25 default, and no config.json).

ledger-mcp: a module spec (MCP 2025-06-18 tools, JSON-RPC 2.0, the
operating contract). Amounts in are exactly -?digits[.digits]; a number
that is one account's code and another's id (vendors, classes alike) is
refused, not guessed; the threshold is validated at startup. Fixed:
add_line with a bad class journaled the line before refusing;
profit_and_loss_by_class ignored `class`; aging buckets said "0". A wire
in front of rmcp answers malformed JSON with -32700 and invalid requests
with -32600 and their id (rmcp dropped the first, omitted the id).
tests/spec_mcp.rs (26 spec-blind tests: every tool's result against its
own outputSchema, a random-call state machine checking the journal is
untouched by every refusal, amount grammar, previews, the receipt policy).

ledger-gui: money, accounting, and dollars never round (they rounded to
cents, banker's style); export file names avoid Windows device names,
trailing dots and spaces, empty names, and 255-byte overflow; specs on
attention, history, fuzzy search, and axis ticks.

ledger-core: the lifetime profit_and_loss is renamed unclosed_earnings
(docs/testing.md #3).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX

docs/mcp-interface.md

@@ -85,14 +85,13 @@ below.
 - `books.draft_entry { date: "2026-10-10", description: "..." }`
   → `{ entry_id, status: "draft" }`.
 - `books.add_line { entry_id, account: "1000" | <id>, side: "debit" | "credit",
-  amount: "123.45" }`
-  → `{ lines: [...], totals: { debits, credits, balanced } }`. Running totals
-  after every line: the agent watches the entry balance in real time.
-- `books.post_entry { entry_id, confirmed }` → without confirmation:
-  `{ preview: { lines, resulting_balances, receipts: { attached: [...],
-  required_but_missing: bool } } }`; with confirmation: validates (including
-  the receipt policy), posts, returns `{ entry, balances_changed: [{ code,
-  before, after }] }`.
+  amount: "123.45" }` → `{ ok: true }`. A refused line (unknown account or
+  class, bad amount) adds nothing.
+- `books.post_entry { entry_id, confirmed }` → `{ status, entry_id, date,
+  description, total, lines (with resulting balances), receipts,
+  receipt_required, receipt_missing, split_detected }`. Without
+  `confirmed: true`, `status` is `"preview"` and nothing changes; with it,
+  the receipt policy is enforced and `status` is `"posted"`.
 - `books.reverse_entry { entry_id, date, description, confirmed }` → same
   preview/confirm pattern as post.
 - `books.get_entry { entry_id }` → full entry with lines.
@@ -492,8 +491,9 @@ entries.
 - `books.add_line` gains optional `class` (name or id): tags the new line.
   Shared costs are split explicitly across lines at entry time.
 - `books.profit_and_loss` gains optional `class` filter.
-- `books.profit_and_loss_by_class { start, end }` → per-class revenue,
-  expenses, net income, plus an unclassified row. Reversals carry their
+- `books.profit_and_loss_by_class { start, end, class? }` → per-class revenue,
+  expenses, net income, plus an unclassified row (only that class's row
+  when `class` is given; an unknown or ambiguous class is refused). Reversals carry their
   class so divisional P&L nets correctly.
 
 ## Tools — CPA handoff