config, mcp, gui: specs from sources, spec-blind suites, and the bugs they found

ledger-config: parse gets a sourced spec. A fiscal year starts on the
first of a month (IRS Pub. 538); tax_classification is read by whole
words (Treas. Reg. 301.7701-3, Schedule C instructions; "business corp"
no longer reads as an S corp, "corporation or S corporation" is refused);
duplicate or blank members and shared capital accounts are refused; a
negative or non-grammatical receipt threshold is refused; codes trimmed.
tests/spec_config.rs (65 spec-blind tests, 14 properties), fuzz target
fuzz_config_parse (weekly). Mutation: 55 of 55 viable caught (from 25/38).

The receipt policy moves to ledger-config, with one loader
(effective_receipt_policy) and one decimal grammar, so the server and
the viewer enforce and show the same rule (the viewer had its own: only
expense-like debits, a silent $25 default, and no config.json).

ledger-mcp: a module spec (MCP 2025-06-18 tools, JSON-RPC 2.0, the
operating contract). Amounts in are exactly -?digits[.digits]; a number
that is one account's code and another's id (vendors, classes alike) is
refused, not guessed; the threshold is validated at startup. Fixed:
add_line with a bad class journaled the line before refusing;
profit_and_loss_by_class ignored `class`; aging buckets said "0". A wire
in front of rmcp answers malformed JSON with -32700 and invalid requests
with -32600 and their id (rmcp dropped the first, omitted the id).
tests/spec_mcp.rs (26 spec-blind tests: every tool's result against its
own outputSchema, a random-call state machine checking the journal is
untouched by every refusal, amount grammar, previews, the receipt policy).

ledger-gui: money, accounting, and dollars never round (they rounded to
cents, banker's style); export file names avoid Windows device names,
trailing dots and spaces, empty names, and 255-byte overflow; specs on
attention, history, fuzzy search, and axis ticks.

ledger-core: the lifetime profit_and_loss is renamed unclosed_earnings
(docs/testing.md #3).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX

crates/ledger-gui/src/export.rs

@@ -20,6 +20,23 @@ pub fn downloads_dir() -> PathBuf {
 }
 
 /// `name` made safe as a file name on every platform.
+///
+/// ```text
+/// GOAL: a report title (company data) can never name a file outside the
+///       downloads folder, or one a platform refuses.
+/// SOURCE: docs/spec/sources/file-names.md (Microsoft's naming rules;
+///         POSIX NAME_MAX).
+/// INVARIANTS:
+///   1. The result is `<base>.<ext>`, `base` holding no reserved
+///      character (< > : " / \ | ? *) and no control character: each is
+///      replaced ('-' or a space).
+///   2. `base` is never empty, never "." or "..", never ends with a space
+///      or a period, and is never a reserved device name (CON, NUL, COM1,
+///      LPT¹, ... in any case, before its first period): such a base gets
+///      a leading '_'.
+///   3. The whole name is at most 255 bytes of UTF-8, cut at a character
+///      boundary.
+/// ```
 pub fn file_name(name: &str, ext: &str) -> String {
     let clean: String = name
         .chars()
@@ -29,7 +46,54 @@ pub fn file_name(name: &str, ext: &str) -> String {
             c => c,
         })
         .collect();
-    format!("{}.{ext}", clean.trim())
+    let mut base = clean.trim().trim_end_matches(['.', ' ']).to_string();
+    if base.is_empty() {
+        base = "report".to_string();
+    }
+    let stem = base
+        .split('.')
+        .next()
+        .unwrap_or("")
+        .trim_end()
+        .to_uppercase();
+    let reserved = matches!(stem.as_str(), "CON" | "PRN" | "AUX" | "NUL")
+        || ["COM", "LPT"].iter().any(|p| {
+            stem.strip_prefix(p).is_some_and(|n| {
+                matches!(
+                    n,
+                    "1" | "2"
+                        | "3"
+                        | "4"
+                        | "5"
+                        | "6"
+                        | "7"
+                        | "8"
+                        | "9"
+                        | "\u{b9}"
+                        | "\u{b2}"
+                        | "\u{b3}"
+                )
+            })
+        });
+    if reserved {
+        base.insert(0, '_');
+    }
+    let limit = 255usize.saturating_sub(ext.len() + 1);
+    if base.len() > limit {
+        let mut cut = limit;
+        while !base.is_char_boundary(cut) {
+            cut -= 1;
+        }
+        base.truncate(cut);
+        // A cut can leave a trailing space or period: trim again.
+        while base.ends_with(['.', ' ']) {
+            base.pop();
+        }
+        if base.is_empty() {
+            base = "report".to_string();
+        }
+    }
+    format!("{base}.{ext}")
 }
 
 /// Write `bytes` to the downloads folder as `name.ext` (replacing a file