docs: the 2026-10-28 drift review; the plan, status and docs brought to date

The planning session read plan/served.md, every design document and the
five branches the owner paused on 2026-10-27 against main (44ee4083),
with dry-run merges touching no branch. plan/2026-10-28_DRIFT_REPORT.md
lists every divergence and judges every recorded departure (all kept;
three owed back; one needs a decision: P6 made ledger-store depend on
ledger-import).

The plan: section 0 "What changed on 2026-10-28"; 8.0.1 and the unit
Status lines name S4.4, S5, S6, S7 and P6 as built but unmerged; 8.0.2
records the destination (D-56: the installed app, P11a starts now) and
the resume order with the known conflicts (the shared documents.rs
test file, the types.rs appends, P6 retaking schema 18, the law numbers
34 to 37); 8.0.3 lists the names the EM approved during the wave; P11a
gains step 0 (the macOS and Windows keyring stores, the Windows data
root and pipes, a cross-platform CI build: today the agent path runs on
Linux alone); Q-5 is due and Q-8 asks whether D-47 to D-54 stand; the
Landlock sentences in section 2 and server.toml are struck.

STATUS.md and HANDOFF.md say where things stand and how to resume;
roadmap.md and gui.md are rewritten to today. The docs lose their
stale facts: 122 tools, 2,700 tests, the parity floor at 21 with the
P4b notes the slices never wrote, the ten crates and their dependency
graph (jiff added to the core's allowed list), the cutover of
2026-10-20 recorded in capability-parity.md and parallel-run.md, the
P4b S1 law and its two Kani harnesses added to verification.md (law
34), the proof counts (51 and 9), and README, the site and install.sh
honest about macOS (the viewer runs; connecting an agent waits for
P11a's keyring store, and the installer now says so instead of failing).

just check on main at 44ee4083: exit 0 (167 suites, 2,871 passed, 0
failed, 7 ignored, the server-only build clean). No code changed.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp

README.md

@@ -16,7 +16,7 @@ through MCP. Self-hosted, no rent.
   append-only, hash-chained JSONL journal; SQLite is a disposable
   projection rebuilt from it; receipts live in a content-addressed blob
   store. Drafts are durable, corrupt projections self-heal.
-- **`ledger-mcp`** — the AI-first interface. 118 MCP tools, served by the
+- **`ledger-mcp`** — the AI-first interface. 122 MCP tools (2026-10-28), served by the
   books server (`wanderbooks server`) on the data root's local sockets and
   reached through the agents' bridge (`wanderbooks mcp --book ID`): draft →
   preview → post workflow, server-side receipt
@@ -39,7 +39,7 @@ through MCP. Self-hosted, no rent.
 This is the storytold way applied to accounting: agents verify against
 oracles, never ship what they haven't demonstrated.
 
-- 190+ workspace tests: invariant tests encoding accounting law, golden-file
+- About 2,700 tests across the two workspaces (2026-10-28): invariant tests encoding accounting law, golden-file
   report snapshots, property tests (proptest), end-to-end MCP tests through
   a real books server.
 - **Formal proofs of the accounting laws** (`just prove`,
@@ -51,8 +51,9 @@ oracles, never ship what they haven't demonstrated.
   pass found three engine bugs that every test, fuzzer, and mutant had
   missed: negative amounts accepted, and two crashes on oversized
   amounts. It also caught a soundness bug in the model checker itself.
-- Mutation testing via cargo-mutants; fuzzing via cargo-fuzz (11.5M+
-  executions, zero crashes).
+- Mutation testing via cargo-mutants (paused for development until the
+  P12 max-testing pass, D-33; CI's weekly shards still run); fuzzing via
+  cargo-fuzz (11.5M+ executions, zero crashes).
 - GnuCash is *a* behavioral cross-check, never the authority and never
   a code source (clean room, MIT OR Apache-2.0). Accounting principles,
   proved, are the spec. Where any other program disagrees, we work out
@@ -60,10 +61,16 @@ oracles, never ship what they haven't demonstrated.
 
 ## Status
 
-Parity is 12 of 12 against the spreadsheet workflow it replaces
-(`docs/capability-parity.md`). The parallel-run plan
-(`docs/parallel-run.md`) is written; the Google Sheet stays the system of
-record until a clean month and explicit cutover approval.
+Parity is 12 of 12 against the spreadsheet workflow it replaced
+(`docs/capability-parity.md`); the books cut over on 2026-10-20 and the
+Sheet is frozen as of 2026-10-11. The remaining work, its order and its
+hand-off are `plan/served.md` section 8.0; the destination is one
+installed app for Mac, Windows and Linux (P11), then the hosted service
+the plan describes and does not build. Today the agent path runs on
+Linux: tokens live in the OS keyring and only the Linux Secret Service
+store exists, so on macOS the viewer and server run but `wanderbooks
+connect` and the agent bridge wait for P11's keyring stores; Windows is
+WSL2 only.
 
 See [`plan/STATUS.md`](plan/STATUS.md) for where things stand and
 [`plan/roadmap.md`](plan/roadmap.md) for where it's going.
@@ -82,6 +89,10 @@ them; nothing needs sudo):
 curl -fsSL https://wanderbooks.ai/install.sh | sh -s -- acme
 ```
 
+(Linux today. On macOS the same line installs and sets up, and the
+viewer runs, but connecting an agent waits for P11's keyring store; on
+Windows run it inside WSL2.)
+
 Already installed, three commands: `wanderbooks setup`, `wanderbooks books
 create acme`, `wanderbooks connect claude --book acme` (or `connect codex`).
 Then talk to the agent; `wanderbooks gui acme` shows the books, and its
@@ -102,15 +113,21 @@ just          # lists the recipes: check, build, prove, demo, ...
 ```
 crates/ledger-core/    # engine: money, accounts, journal, ledger, reports
 crates/ledger-store/   # journal + SQLite projection + blob store
-crates/ledger-mcp/     # MCP server: 118 tools, resources, handbook, receipt policy
+crates/ledger-mcp/     # MCP server: 122 tools, resources, handbook, receipt policy
 crates/ledger-import/  # QBO CSV import, IIF/XLSX export
 crates/ledger-config/  # wanderbooks.toml company settings
 crates/ledger-cli/     # `wanderbooks`: the one executable (every mode)
 crates/ledger-host/    # the host, the agents' bridge, the owner's commands
-crates/ledger-package/ # The CPA package and the 1099 worksheet (server and viewer)
+crates/ledger-package/ # the shared read-only view: the CPA package, the invoice PDF, Needs attention
+crates/ledger-vault/   # the TIN vault (XChaCha20-Poly1305 under the book's key)
 crates/ledger-gui/     # the viewer: read-only, live (egui)
-docs/                  # requirements, architecture, oracle, parity, glossary
-plan/                  # STATUS.md, roadmap.md
+verify/lean/           # the accounting laws as Lean theorems (`just prove`)
+bookspec/              # the formal accounting specification: checker, runner, examples (P13)
+fuzz/, oracle/         # fuzz targets; the GnuCash differential (`just oracle`)
+deploy/                # the self-host recipe and system unit (P9a)
+site/                  # wanderbooks.ai and install.sh
+docs/                  # requirements, architecture, oracle, parity, testing, verification, spec, glossary
+plan/                  # served.md (the plan), STATUS.md, roadmap.md, HANDOFF.md, gui.md
 AGENTS.md              # operating manual for agents working here
 ```