plan: Served — books behind the MCP, local and self-hosted

The 2026-10-16 audit of the first company's books found an agent reading
the journal file directly, the instructions truncated by clients, and 20
engine defects. plan/served.md is the plan to fix all of it: the books
become a server that owns its data, every agent reaches them only
through the MCP from any directory or client, settings and conventions
move into the journal, and the scaffold goes away. Phases P0-P10, ending
with a full re-audit through the MCP alone.

Chosen from three independent designs by a three-judge panel, then
revised for the owner's decisions: books kept as the user in a private
data root (advisory isolation, labelled so; enforcement is the self-host
deployment), the viewer reads the data directly, no added permission
prompts, self-hosting now and multi-tenant hosting later.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj

plan/roadmap.md

@@ -22,7 +22,15 @@ The primary interface is MCP, not a cloned GUI (Stephen's call, 2026-10-10).
 - Parallel run with the sheet; cutover per the cutover rule
   (`docs/parallel-run.md`).
 
-## Phase 3 — Oracle harness (next)
+## Served (next, 2026-10-16)
+
+The books become a server that owns its data; every agent reaches them
+only through the MCP, from anywhere; no scaffold. Phases P0 (guard
+rails) through P10 (full re-audit of the first company's books through
+the MCP alone), with the owner's decisions of 2026-10-16:
+`plan/served.md`.
+
+## Phase 3 — Oracle harness
 
 - `ledger-oracle`: fixture books through our engine and other
   implementations (GnuCash headless first), automatic `snapshot()`