refactor!: one way to serve books: the stdio server is gone (D-44)

The owner (2026-10-23): "We should probably just delete the stdio path
altogether. THere's no point in that. And it sitting there unused will
just lead to bitrot. Nuke it?"

Books are served only by the books server (`wanderbooks server`),
reached by agents through the bridge (`wanderbooks mcp --book ID`),
which stays.

Removed: `wanderbooks dev-stdio`, the `ledger-mcp` binary, and
`ledger_mcp::run` (stdio and `--http` over a bare data dir), with all
that only that mode had:
- files the books make coming back inline: `HandedFile.content_base64`
  is gone, and `download` and `expires_at` are always there;
- books with no access log or backups: `books.access_log`,
  `books.backup` and `books.back_up_now` are always offered, by scope;
- the settings file read and reloaded (`legacy_files`), the vault key
  named by a file or `--vault-key-file`, and the books dir's
  key-inside-the-books and git checks (with `paths.rs`);
- `wire.rs` (the bridge frames an agent's lines itself);
- `books.settings`' file fields and `books.start`'s `settings_source`.

`BooksServer` is built one way, from `Served` (a book as the books
server serves it), in production and in the unit tests. An unknown tool
is now a protocol error (mcp-tools.md). Inline file input is unchanged.

Then the owner's three decisions (2026-10-23, the question tool):
(a) `books.import_settings` is removed entirely (118 tools): old books
come in whole by `wanderbooks books adopt`, which reads their settings
file once; ledger-config keeps its settings-file parsing only as far as
adoption uses it (`load` and the path-reading `effective_receipt_policy`
are gone), and `books.chart_template` gives its settings as
`books.set_setting` changes. (b) The viewer's loose-books-folder mode is
removed (`--data-dir`, `--books-toml`, `--vault-key-file`, the settings
file and config.json followed): it opens only books of the data root,
reading settings from the journal and the vault from the book's own
`vault/` and `keys/`. (c) `wanderbooks dev-stdio` has no stub: it is an
unknown command like any other word. Also: an upload's expiry past the
calendar is an error, never an empty string.

Tests: every suite that drove the stdio server moved to
crates/ledger-cli/tests/ and drives a real `wanderbooks server` on a
data root of its own (tests/common), handed files by their download;
mcp_stdio.rs is mcp_journeys.rs. Tests of what is gone are deleted and
listed in docs/testing.md. Docs: plan D-44 (D-18 superseded), STATUS,
testing, rules, mcp-interface, the handbook, README; justfile recipes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj

crates/ledger-cli/tests/startup.rs

@@ -0,0 +1,118 @@
+//! Starting the books server on books it can't serve: books another
+//! program holds, and books a newer wanderbooks wrote. Oracle: ledger-mcp
+//! local.rs INVARIANT 3 (every book is tried before the server says it is
+//! ready; one that won't open is reported with why, on its route and in
+//! the list, and the others are served) and rules.md B-27 (newer books
+//! are refused as newer, never as corrupt, and left as they are).
+
+use common::{Home, Server, Wire};
+use ledger_mcp::admin::{Request, Response};
+use serde_json::json;
+use std::time::{Duration, Instant};
+
+mod common;
+
+/// New books `id` written in `home`'s root by the store itself, before a
+/// server opens them; the store, still open.
+fn written(home: &Home, id: &str) -> ledger_store::Store {
+    use std::os::unix::fs::PermissionsExt;
+    let dir = home.book_dir(id);
+    let store = ledger_store::Store::create(&dir, ledger_core::Currency::USD).unwrap();
+    std::fs::set_permissions(&dir, std::fs::Permissions::from_mode(0o700)).unwrap();
+    store
+}
+
+/// What the server's list says of `id`: whether it is open, and why not.
+fn listed(home: &Home, id: &str) -> (bool, Option<String>) {
+    match home.admin(Request::List) {
+        Response::Books(list) => {
+            let b = list
+                .into_iter()
+                .find(|b| b.id == id)
+                .unwrap_or_else(|| panic!("{id} isn't listed"));
+            (b.open, b.problem)
+        }
+        other => panic!("{other:?}"),
+    }
+}
+
+/// A request to `id`'s route is refused before it runs, with why.
+fn refused_at_the_door(home: &Home, id: &str, why: &str) {
+    let mut wire = Wire::with_token(home, id, None);
+    wire.send(
+        &json!({"jsonrpc": "2.0", "id": 1, "method": "initialize", "params": {
+        "protocolVersion": common::PROTOCOL, "capabilities": {},
+        "clientInfo": {"name": "t", "version": "0"}}}),
+    );
+    let refusal = wire.refused.clone().expect("refused");
+    assert!(refusal.not_run, "{refusal:?}");
+    assert!(refusal.body.contains(why), "{refusal:?}");
+    home.assert_hidden(&refusal.body);
+}
+
+/// A writer that keeps the books is a conflict: the server reports those
+/// books not open, with why, serves the others, and never hangs on them.
+#[test]
+fn a_held_lock_is_refused_not_waited_on_forever() {
+    let home = Home::new("start-locked");
+    let _holder = written(&home, "acme");
+    drop(written(&home, "beta"));
+    let start = Instant::now();
+    let server = Server::start(&home);
+    assert!(
+        start.elapsed() < Duration::from_secs(60),
+        "the server waited on a held lock"
+    );
+    let (open, problem) = listed(&home, "acme");
+    assert!(!open);
+    let problem = problem.expect("why");
+    assert!(
+        problem.contains("another program has these books open"),
+        "{problem}"
+    );
+    refused_at_the_door(&home, "acme", "another program has these books open");
+    // The others are served.
+    assert_eq!(listed(&home, "beta"), (true, None));
+    let mut beta = Wire::new(&home, "beta");
+    beta.initialize("t");
+    let chart = beta.call("books.chart", json!({}));
+    assert_eq!(chart["result"]["isError"], json!(false), "{chart}");
+    assert!(server.close().success());
+}
+
+/// Books written by a newer wanderbooks: the server won't open them, and
+/// says to update it, not that the books are corrupt (rules.md B-27); it
+/// leaves them as they are.
+#[test]
+fn newer_books_are_refused_as_newer_not_corrupt() {
+    let home = Home::new("start-newer");
+    drop(written(&home, "acme"));
+    let dir = home.book_dir("acme");
+    let mut w = ledger_store::JournalWriter::open(&dir.join(ledger_store::JOURNAL_FILE)).unwrap();
+    w.append("journal.format_set", json!({"format": 3, "features": []}))
+        .unwrap();
+    // The next line chains onto it, so its bytes are checked (B-27).
+    w.append(
+        "fx.rate_set",
+        json!({"currency": "EUR", "date": "2026-10-01", "rate": "1.10"}),
+    )
+    .unwrap();
+    drop(w);
+    let journal = std::fs::read(dir.join(ledger_store::JOURNAL_FILE)).unwrap();
+    let server = Server::start(&home);
+    let (open, problem) = listed(&home, "acme");
+    assert!(!open);
+    let err = problem.expect("why");
+    assert!(
+        err.contains("written by a newer version of wanderbooks"),
+        "{err}"
+    );
+    assert!(err.contains("Update wanderbooks"), "{err}");
+    assert!(!err.contains("corrupt"), "{err}");
+    refused_at_the_door(&home, "acme", "Update wanderbooks");
+    assert!(server.close().success());
+    assert_eq!(
+        std::fs::read(dir.join(ledger_store::JOURNAL_FILE)).unwrap(),
+        journal
+    );
+}