docs: the 2026-10-28 drift review; the plan, status and docs brought to date

The planning session read plan/served.md, every design document and the
five branches the owner paused on 2026-10-27 against main (44ee4083),
with dry-run merges touching no branch. plan/2026-10-28_DRIFT_REPORT.md
lists every divergence and judges every recorded departure (all kept;
three owed back; one needs a decision: P6 made ledger-store depend on
ledger-import).

The plan: section 0 "What changed on 2026-10-28"; 8.0.1 and the unit
Status lines name S4.4, S5, S6, S7 and P6 as built but unmerged; 8.0.2
records the destination (D-56: the installed app, P11a starts now) and
the resume order with the known conflicts (the shared documents.rs
test file, the types.rs appends, P6 retaking schema 18, the law numbers
34 to 37); 8.0.3 lists the names the EM approved during the wave; P11a
gains step 0 (the macOS and Windows keyring stores, the Windows data
root and pipes, a cross-platform CI build: today the agent path runs on
Linux alone); Q-5 is due and Q-8 asks whether D-47 to D-54 stand; the
Landlock sentences in section 2 and server.toml are struck.

STATUS.md and HANDOFF.md say where things stand and how to resume;
roadmap.md and gui.md are rewritten to today. The docs lose their
stale facts: 122 tools, 2,700 tests, the parity floor at 21 with the
P4b notes the slices never wrote, the ten crates and their dependency
graph (jiff added to the core's allowed list), the cutover of
2026-10-20 recorded in capability-parity.md and parallel-run.md, the
P4b S1 law and its two Kani harnesses added to verification.md (law
34), the proof counts (51 and 9), and README, the site and install.sh
honest about macOS (the viewer runs; connecting an agent waits for
P11a's keyring store, and the installer now says so instead of failing).

just check on main at 44ee4083: exit 0 (167 suites, 2,871 passed, 0
failed, 7 ignored, the server-only build clean). No code changed.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp

docs/requirements.md

@@ -97,11 +97,14 @@ requirement conflict, the requirement wins.
   receipts and documents are withdrawn with a reason. Unlinking may never
   leave an entry the policy (R-13) requires a receipt for with none. Every
   step is a journal event; no blob is deleted.
-- **R-13 — Receipt enforcement.** The MCP layer (not the engine — the engine
-  stays policy-free) enforces a configurable receipt policy: postings at or
-  above a threshold (`require_receipts_above`, default `"25.00"` in base
-  currency) must have at least one attached receipt, with per-account
-  overrides. `post_entry` with `confirmed: true` refuses with a typed
+- **R-13 — Receipt enforcement.** The server (not the engine — the engine
+  stays policy-free) enforces the books' evidence policy: postings at or
+  above a threshold (the journaled setting `policy.evidence.threshold`,
+  with required and exempt accounts; P1, rules.md B-29) must have at least
+  one attached receipt. Evaluated by `ledger-config`'s `ReceiptPolicy`
+  today; P4 moves the evaluation into `ledger_core::evidence` so the
+  store, the server and the viewer call one function (plan I-5, D-47:
+  reversals, closes, schedule and depreciation runs are exempt by origin). `post_entry` with `confirmed: true` refuses with a typed
   `receipt_required` error otherwise. The draft preview always includes the
   receipt checklist (`attached: [...]`, `required_but_missing: bool`), so the
   human sees it before confirming. Full spec: `docs/mcp-interface.md`.
@@ -162,7 +165,14 @@ requirement conflict, the requirement wins.
   overridable threshold. Schema v7.
 - **R-? — A/R and A/P workflows.** Was R-FUTURE-5.
   `ledger-core::arap`: customers, vendors, invoices, bills, payments,
-  AR/AP aging. MCP tools for the full workflow.
+  AR/AP aging. MCP tools for the full workflow. Since P4b S1 (D-45,
+  rules.md B-38): a document's figures are the signed sum of its tagged
+  ledger lines dated on or before the day asked about, so reversals,
+  voids and write-offs are right by construction; a hand line on a
+  control account is refused; `books.control_check` ties the subledger to
+  the control account. S4 to S7 add terms, numbers, line accounts, the
+  issued PDF, sends, settlements with discounts and the processor's fee,
+  and bad debts, behind the `documents_v2` journal feature.
 - **R-? — Bank reconciliation.** Cleared flags on posted lines,
   `reconciliation_report` with uncleared-line detail.
 - **R-? — Payroll (accounting only).** `ledger-core::payroll`:
@@ -173,9 +183,13 @@ requirement conflict, the requirement wins.
   `JournalLine.class_id`, `add_class`, `set_line_class` (drafts only),
   `profit_and_loss_filtered`, `profit_and_loss_by_class`. Shared costs are
   split explicitly across lines at entry time.
-- **R-? — CPA handoff package.** `books.export_cpa_package`: zip with
-  trial-balance XLSX, general-ledger XLSX (every posted line), P&L and
-  balance-sheet PDFs (printpdf, MIT).
+- **R-? — CPA handoff package.** `books.export_cpa_package` (and the
+  viewer's Export menu, D-29): a zip, built by `ledger-package` for both,
+  as of a day (B-33), with the trial balance and general ledger as XLSX,
+  the statements as Typst PDFs, the journal as IIF (B-34), every receipt
+  behind the period's entries with an index, the company's documents, the
+  1099 worksheet, the members' equity and K-1 worksheets (book and tax
+  basis, B-36), and a README; handed over as a download (D-46).
 
 ## Non-goals (all phases of the engine)