refactor!: one way to serve books: the stdio server is gone (D-44)

The owner (2026-10-23): "We should probably just delete the stdio path
altogether. THere's no point in that. And it sitting there unused will
just lead to bitrot. Nuke it?"

Books are served only by the books server (`wanderbooks server`),
reached by agents through the bridge (`wanderbooks mcp --book ID`),
which stays.

Removed: `wanderbooks dev-stdio`, the `ledger-mcp` binary, and
`ledger_mcp::run` (stdio and `--http` over a bare data dir), with all
that only that mode had:
- files the books make coming back inline: `HandedFile.content_base64`
  is gone, and `download` and `expires_at` are always there;
- books with no access log or backups: `books.access_log`,
  `books.backup` and `books.back_up_now` are always offered, by scope;
- the settings file read and reloaded (`legacy_files`), the vault key
  named by a file or `--vault-key-file`, and the books dir's
  key-inside-the-books and git checks (with `paths.rs`);
- `wire.rs` (the bridge frames an agent's lines itself);
- `books.settings`' file fields and `books.start`'s `settings_source`.

`BooksServer` is built one way, from `Served` (a book as the books
server serves it), in production and in the unit tests. An unknown tool
is now a protocol error (mcp-tools.md). Inline file input is unchanged.

Then the owner's three decisions (2026-10-23, the question tool):
(a) `books.import_settings` is removed entirely (118 tools): old books
come in whole by `wanderbooks books adopt`, which reads their settings
file once; ledger-config keeps its settings-file parsing only as far as
adoption uses it (`load` and the path-reading `effective_receipt_policy`
are gone), and `books.chart_template` gives its settings as
`books.set_setting` changes. (b) The viewer's loose-books-folder mode is
removed (`--data-dir`, `--books-toml`, `--vault-key-file`, the settings
file and config.json followed): it opens only books of the data root,
reading settings from the journal and the vault from the book's own
`vault/` and `keys/`. (c) `wanderbooks dev-stdio` has no stub: it is an
unknown command like any other word. Also: an upload's expiry past the
calendar is an error, never an empty string.

Tests: every suite that drove the stdio server moved to
crates/ledger-cli/tests/ and drives a real `wanderbooks server` on a
data root of its own (tests/common), handed files by their download;
mcp_stdio.rs is mcp_journeys.rs. Tests of what is gone are deleted and
listed in docs/testing.md. Docs: plan D-44 (D-18 superseded), STATUS,
testing, rules, mcp-interface, the handbook, README; justfile recipes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj

crates/ledger-gui/src/books.rs

@@ -16,7 +16,7 @@ use ledger_store::{Attachment, JournalLine, Reconciliation, Snapshot, Statement,
 use rust_decimal::Decimal;
 use serde_json::Value;
 use std::collections::{BTreeMap, HashMap, HashSet};
-use std::path::{Path, PathBuf};
+use std::path::PathBuf;
 
 use crate::nav::Route;
 
@@ -597,18 +597,8 @@ impl Books {
         let attachments = snap.attachments(None).map_err(|e| e.to_string())?;
         let journal = snap.journal().to_vec();
         // The server's own rule, so the viewer flags exactly what the
-        // server would refuse: the books' settings; for an older books dir
-        // that keeps none, its config.json, else its settings file.
-        let policy = if ledger.settings().is_journaled()
-            || ledger_store::root::inside_a_root(snap.data_dir())
-        {
-            ledger_config::codec::receipt_policy(ledger.settings())
-        } else {
-            ledger_config::effective_receipt_policy(
-                &snap.data_dir().join("config.json"),
-                &settings,
-            )?
-        };
+        // server would refuse: the books' settings.
+        let policy = ledger_config::codec::receipt_policy(ledger.settings());
         let receipt_threshold = policy.threshold();
         let cash_accounts = cash_accounts(&ledger, &settings);
         let members = settings.company.party_members(&ledger);
@@ -1658,15 +1648,6 @@ impl Books {
         ledger_core::parties::activity_with(&self.ledger, party, span, &self.money, &self.members)
     }
 
-    /// The books dir: the folder holding `books-data/` (and `vault/`).
-    fn books_dir(&self) -> PathBuf {
-        let d = self
-            .data_dir
-            .canonicalize()
-            .unwrap_or_else(|_| self.data_dir.clone());
-        d.parent().map(Path::to_path_buf).unwrap_or(d)
-    }
-
     /// A party's full TIN from the encrypted vault, formatted
     /// ("123-45-6789" for an SSN or ITIN, "12-3456789" for an EIN), for the
     /// clipboard only: never drawn on screen.
@@ -1675,12 +1656,8 @@ impl Books {
     /// INVARIANT 1: read only on demand (a click), never on load or paint.
     /// INVARIANT 2: never creates a key file; a missing key is a locked
     ///   vault ("restore it from your password manager").
-    /// INVARIANT 3: the vault and key are the server's: for a book in the
-    ///   data root, its own `vault/` and `keys/legacy.key`; for older
-    ///   books, `vault/` beside `books-data/` and the key file the one
-    ///   given on the command line (--vault-key-file), else the settings'
-    ///   [vault] key_file, else ~/.config/wanderbooks/vault.key, one
-    ///   inside the books dir refused, as the server refuses it.
+    /// INVARIANT 3: the vault and key are the server's: the book's own
+    ///   `vault/` and `keys/legacy.key` (a book of the data root, D-44).
     /// INVARIANT 4: an error never carries the digits (the vault's errors
     ///   are redacted); a party with no record is "not in the vault".
     /// ```
@@ -1694,26 +1671,13 @@ impl Books {
     }
 
     /// Where the vault and its key are (INVARIANT 3 of [`Self::tin_from_vault`]).
-    fn vault_place(&self) -> Result<(PathBuf, PathBuf), String> {
-        if ledger_store::root::inside_a_root(&self.data_dir) {
-            return Ok((
-                self.data_dir.join(ledger_store::root::VAULT_DIR),
-                self.data_dir
-                    .join(ledger_store::root::KEYS_DIR)
-                    .join(ledger_store::root::LEGACY_KEY_FILE),
-            ));
-        }
-        let key = crate::vault_key_file()
-            .or_else(|| self.settings.vault_key_file.clone())
-            .unwrap_or_else(ledger_vault::default_key_file);
-        let books = self.books_dir();
-        if resolved(&key).starts_with(resolved(&books)) {
-            return Err(format!(
-                "The vault key file {} is inside the books folder: move it out, and name its new place to the server and the viewer (--vault-key-file).",
-                key.display()
-            ));
-        }
-        Ok((books.join("vault"), key))
+    fn vault_place(&self) -> (PathBuf, PathBuf) {
+        (
+            self.data_dir.join(ledger_store::root::VAULT_DIR),
+            self.data_dir
+                .join(ledger_store::root::KEYS_DIR)
+                .join(ledger_store::root::LEGACY_KEY_FILE),
+        )
     }
 
     /// A party's signed W-9 file from the vault, on demand (a click).
@@ -1727,7 +1691,7 @@ impl Books {
     /// The vault, opened read-only, never making a key (a missing one is a
     /// locked vault).
     pub fn open_vault(&self) -> Result<ledger_vault::Vault, String> {
-        let (dir, key) = self.vault_place()?;
+        let (dir, key) = self.vault_place();
         ledger_vault::Vault::open(&dir, &key, false).map_err(
             |e| match e {
                 ledger_vault::Error::NoKey(k) => format!(
@@ -2287,28 +2251,3 @@ fn origin(events: &[usize], journal: &[JournalLine], closing: bool) -> &'static
 fn cash_accounts(ledger: &Ledger, settings: &BooksSettings) -> Vec<AccountId> {
     ledger_store::reconcilable::cash_accounts(ledger, &settings.cash_accounts)
 }
-
-/// `path` made absolute through its nearest existing ancestor (symlinks
-/// resolved), so a path that doesn't exist yet can still be placed: the
-/// server's rule for where the vault key may live.
-fn resolved(path: &Path) -> PathBuf {
-    let abs = if path.is_absolute() {
-        path.to_path_buf()
-    } else {
-        std::env::current_dir().unwrap_or_default().join(path)
-    };
-    let mut base = abs.as_path();
-    let mut rest = Vec::new();
-    while !base.exists() {
-        match (base.file_name(), base.parent()) {
-            (Some(name), Some(up)) => {
-                rest.push(name.to_os_string());
-                base = up;
-            }
-            _ => return abs,
-        }
-    }
-    let mut out = base.canonicalize().unwrap_or_else(|_| base.to_path_buf());
-    out.extend(rest.into_iter().rev());
-    out
-}