feat(audit): audit runs and attestations are journaled (P8)

A claim that someone checked the books is evidence the CPA handoff rests on,
so it is a journal fact and replays: audit.run (a programme run through a
day at the books' figure head, with the hashes that make it reproducible and
the two filed workpapers), receipt.attested, entry.reviewed and
period.attested. Behind the journal feature audits, schema 20; no figure
moves. The figure head is the last line that bears on a figure: filing a
workpaper, a run or an attestation never makes an audit stale, an entry,
document, close, settings or role change does, so a period is attested only
on an audit that still describes the books. A receipt reading that differs
from the entry is recorded as disagreeing and never counts; whether a claim
counts is derived against the bar when asked, never stored.

The store also reads what a ledger cannot: the chain, the database against
a replay, stored and extracted files, the access log, duplicate files, and
the backups' standing handed in by the server. Fixture old-books/p8_before
was written by the version before this one and opens to its figures.
period.attested was the tests' placeholder for an unknown event type; they
use ledger.not_yet_written now.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp

crates/ledger-gui/src/pages/journal.rs

@@ -449,6 +449,55 @@ pub fn describe(b: &Books, line: &JournalLine) -> Option<Event> {
             format!("Draft #{id} discarded: {}", s(p, "reason")),
             None,
         ),
+        // Audits and attestations (plan P8): claims about the books, not
+        // figures.
+        "audit.run" => ev(
+            icon::MAGNIFYING_GLASS,
+            format!(
+                "Audit {} through {}",
+                s(p, "scope").replace('_', " "),
+                s(p, "through")
+            ),
+            None,
+        ),
+        "receipt.attested" => ev(
+            icon::CHECK_CIRCLE,
+            if p.get("disagrees").and_then(|v| v.as_bool()) == Some(true) {
+                format!(
+                    "{} read {} against entry #{}: it disagrees",
+                    s(p, "by"),
+                    attachment_name(b, att),
+                    p.get("entry_id").and_then(|v| v.as_u64()).unwrap_or(0)
+                )
+            } else {
+                format!(
+                    "{} attested {} for entry #{}",
+                    s(p, "by"),
+                    attachment_name(b, att),
+                    p.get("entry_id").and_then(|v| v.as_u64()).unwrap_or(0)
+                )
+            },
+            Some(Route::Document(att)),
+        ),
+        "entry.reviewed" => ev(
+            icon::CHECK_CIRCLE,
+            format!(
+                "{} reviewed entry #{}",
+                s(p, "by"),
+                p.get("entry_id").and_then(|v| v.as_u64()).unwrap_or(0)
+            ),
+            p.get("entry_id").and_then(|v| v.as_u64()).map(Route::Entry),
+        ),
+        "period.attested" => ev(
+            icon::CHECK_CIRCLE,
+            format!(
+                "{} attested period #{} on audit #{}",
+                s(p, "by"),
+                p.get("period_id").and_then(|v| v.as_u64()).unwrap_or(0),
+                p.get("audit_run_id").and_then(|v| v.as_u64()).unwrap_or(0)
+            ),
+            None,
+        ),
         "entry.settles" => {
             let settles: Vec<String> = p
                 .get("settles")

crates/ledger-gui/tests/newer_journal.rs

@@ -88,7 +88,11 @@ fn says_update(text: &str) {
 #[test]
 fn the_viewer_says_update_for_newer_books_and_corrupt_for_damaged_ones() {
     for (tag, line_type, payload) in [
-        ("type", "period.attested", json!({"key": "company.name"})),
+        (
+            "type",
+            "ledger.not_yet_written",
+            json!({"key": "company.name"}),
+        ),
         (
             "format",
             "journal.format_set",