docs: the 2026-10-28 drift review; the plan, status and docs brought to date

The planning session read plan/served.md, every design document and the
five branches the owner paused on 2026-10-27 against main (44ee4083),
with dry-run merges touching no branch. plan/2026-10-28_DRIFT_REPORT.md
lists every divergence and judges every recorded departure (all kept;
three owed back; one needs a decision: P6 made ledger-store depend on
ledger-import).

The plan: section 0 "What changed on 2026-10-28"; 8.0.1 and the unit
Status lines name S4.4, S5, S6, S7 and P6 as built but unmerged; 8.0.2
records the destination (D-56: the installed app, P11a starts now) and
the resume order with the known conflicts (the shared documents.rs
test file, the types.rs appends, P6 retaking schema 18, the law numbers
34 to 37); 8.0.3 lists the names the EM approved during the wave; P11a
gains step 0 (the macOS and Windows keyring stores, the Windows data
root and pipes, a cross-platform CI build: today the agent path runs on
Linux alone); Q-5 is due and Q-8 asks whether D-47 to D-54 stand; the
Landlock sentences in section 2 and server.toml are struck.

STATUS.md and HANDOFF.md say where things stand and how to resume;
roadmap.md and gui.md are rewritten to today. The docs lose their
stale facts: 122 tools, 2,700 tests, the parity floor at 21 with the
P4b notes the slices never wrote, the ten crates and their dependency
graph (jiff added to the core's allowed list), the cutover of
2026-10-20 recorded in capability-parity.md and parallel-run.md, the
P4b S1 law and its two Kani harnesses added to verification.md (law
34), the proof counts (51 and 9), and README, the site and install.sh
honest about macOS (the viewer runs; connecting an agent waits for
P11a's keyring store, and the installer now says so instead of failing).

just check on main at 44ee4083: exit 0 (167 suites, 2,871 passed, 0
failed, 7 ignored, the server-only build clean). No code changed.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp

plan/roadmap.md

@@ -1,107 +1,101 @@
 # Roadmap
 
-## Phase 1 — Semantics core (done)
+Where wanderbooks has been, where it is, and where it is going. The
+detailed plan for the remaining work is `plan/served.md` (section 8.0:
+status, order, hand-off); `plan/STATUS.md` says where things stand this
+week. Revised 2026-10-28.
 
-The engine: money, accounts, journal, ledger commands, trial balance, P&L,
-balance sheet, cash flow, fixed assets with depreciation, golden files,
-property tests, mutation testing, fuzzing, and the docs an agent needs to
-work here. Parity floor: 12 done.
+## Done
 
-## Phase 2 — AI-first interface (done)
+### Phase 1 — Semantics core (2026-10-10 to 2026-10-13)
 
-The primary interface is MCP, not a cloned GUI (the owner's call, 2026-10-10).
+The engine: exact money, five account types, balanced entries, the
+immutable posted log with reversals, trial balance, P&L, balance sheet,
+the cash flow statement, period close, fixed assets, schedules, tax
+categories, 1099 tracking, parties, A/R and A/P, payroll (accounting
+only), projects; golden files, property tests, mutation testing, fuzzing;
+the formal methods bar (Kani on the kernel, Lean on the laws,
+`just prove`).
 
-- `ledger-store`: append-only hash-chained JSONL journal (source of truth),
-  SQLite as disposable projection with auto-rebuild, content-addressed
-  blob store, durable drafts.
-- `ledger-mcp`: 27 tools (then over stdio and Streamable HTTP; since D-44
-  served only by the books server), preview-before-post,
-  server-side receipt policy (>$25) with anti-splitting, asset management,
-  digest for human review, read-only resources.
-- `ledger-import`: QuickBooks CSV import (bank, chart), IIF and XLSX export.
-- Capability parity 12 of 12 vs the GSheet+GDrive system.
-- Parallel run with the sheet; cutover per the cutover rule
-  (`docs/parallel-run.md`).
+### Phase 2 — AI-first interface (2026-10-10 to 2026-10-15)
 
-## Served (2026-10-16; reworked for a team 2026-10-26)
+MCP is the primary interface, not a cloned GUI (the owner, 2026-10-10).
+`ledger-store` (hash-chained journal, SQLite projection, blob store),
+`ledger-mcp` (now 122 tools on `main`, 2026-10-28), `ledger-import`
+(QuickBooks CSV in; IIF, XLSX, PDF out), `ledger-package` (the CPA
+package), the read-only viewer `ledger-gui` (first version 2026-10-12;
+`plan/gui.md`). Capability parity 12 of 12 against the GSheet+GDrive
+workflow; the Sheet was frozen as of 2026-10-11 and the books cut over
+on 2026-10-20 (`docs/capability-parity.md`, `docs/parallel-run.md`, both
+historical now).
 
-The remaining work, its order, its dependencies and its hand-off are in
-`plan/served.md` section 8.0; the team's prompt is `plan/HANDOFF.md`.
+### Phase 3 — Oracle harness (partly done)
 
-The books become a server that owns its data; every agent reaches them
-only through the MCP, from anywhere; no scaffold. Phases P0 (guard
-rails) through P10 (full re-audit of the first company's books through
-the MCP alone), with the owner's decisions of 2026-10-16:
-`plan/served.md`.
+Done: the GnuCash differential (`just oracle`: 200 random books, 15,800
+exact comparisons, adjudicated from principles; `docs/oracle.md` Layer
+5), the mutation, fuzz and proof layers. Open: fixture books diffed as
+`snapshot()` output automatically, and the machine-readable parity
+catalog with CI enforcing the non-regression floor (the floor is 21
+`done` rows, enforced by review until then).
 
-## Phase 3 — Oracle harness
+### "Served" P0 to P3, Projects, P4b S1 to S4.3 (2026-10-16 to 2026-10-27)
 
-- `ledger-oracle`: fixture books through our engine and other
-  implementations (GnuCash headless first), automatic `snapshot()`
-  diffing. Each diff is adjudicated from principles; no other program is
-  the authority.
-- Parity catalog becomes machine-readable; CI enforces the non-regression
-  floor.
-- Done when: a fixture book produces byte-identical snapshots from both
-  engines with zero manual steps.
+The books became a server that owns its data, reached only through the
+MCP from anywhere, every setting in the journal, one executable, backups
+that restore, the format gate, the live books moved and re-verified
+(`plan/served.md` 8.1, `plan/STATUS.md`). Engine correctness (the 24
+audit defects), projects, receivables and payables first class
+(documents read their figures from tagged standing lines), the invoice
+PDF, terms, numbers and line accounts in the core and the journal.
 
-## Phase 4 — Read-only GUI (first version done, 2026-10-12)
+## In flight (2026-10-28)
 
-`ledger-gui`: see `plan/gui.md` for the design and what's built.
+Built on paused branches, to be rebased and landed in order: P4b S4.4
+(the create tools preview and confirm; the party contact block, D-55),
+S5 (sent tracking), S6 (paying on terms: multi-document payments,
+discounts, the processor fee, bills due, aging exports), S7 (bad debts),
+P6 (the evidence pipeline: extraction, dedup, annotations). Then S4.5
+(the PDF, viewer and handbook of `documents_v2`) and the owner's one
+`documents_v2` upgrade of the live books (Q-5).
 
-- Consumes the `ledger-store` event log: live updates — the answer to
-  "watch its files to update live."
-- egui or web; a dumb client holding no accounting logic.
-- This is the trust layer for humans (the owner, the other member, the CPA), not the
-  primary interface. Read-only at first; editing stays with the agent.
-- Design references (the owner, 2026-10-11; screenshots shared in session,
-  described here):
-  - **Reports with a date range and a column interval** (QuickBooks
-    Desktop's P&L: From/To plus Columns = Year/Quarter/Month/...): any
-    statement split into one column per interval plus TOTAL, to see the
-    books over time. The multi-column statement layout in
-    `ledger-import::report` already renders this shape; the GUI (and the
-    exports) need a per-interval builder over the period-scoped core
-    statements.
-  - **Financial dashboard** (Coupler.io's QuickBooks dashboard): P&L,
-    balance sheet, and cash flow overview tables with Last month / Month to
-    date / Year to date columns, each beside charts — income vs. COGS +
-    expenses vs. earnings bars; stacked assets vs. liabilities + equity;
-    cash at end of period; net cash change.
-  - **Business overview** (QuickBooks Online home): cards for cash balance
-    with a trend, expenses by category (donut), profit and loss (income
-    vs. expenses), invoices (unpaid, overdue, paid), sales trend, and bank
-    account balances.
-  - **Revenue dashboard** (Coupler.io): KPI tiles (paid, overdue, open
-    invoices this month), an invoice table (number, customer, dates,
-    currency, home and foreign amounts, balance, totals), expenses by
-    category by month, invoices by status per month.
-  - **QuickBooks Online dashboard**: invoices (unpaid in the last year,
-    overdue vs. not yet due; paid in the last 30 days, deposited vs. not),
-    expenses by category (donut, last month), bank account balances (book
-    vs. bank, items to review), profit and loss (net income, income vs.
-    expenses bars), sales trend (line, by quarter).
-  - **KPI tiles with comparison** (QuickBooks accounting dashboard): income,
-    cost of goods sold, expenses, net profit, each with % change vs. the
-    previous 30 days; an auto date-range picker; cash balance over time
-    with a trend line; revenue by month, stacked.
-  - **Cash-flow dashboard**: bank balance, debtors, burn rate, cash runway
-    (days) tiles; income vs. expenses for the last six months; a net cash
-    flow forecast with a confidence band; A/P and A/R aging by days past
-    due (the engine already computes both agings); total burn over time.
+## Next
 
-## Phase 5 — Workflow parity
+The order is `plan/served.md` 8.0.2. Two tracks run beside each other:
 
-- A/R and A/P workflows, bank reconciliation, budgets, scheduled transactions.
-- Multi-currency with FX translation.
-- Period close.
-- The goal: a self-hosted bookkeeping system with a tested claim to
-  proved accounting semantics (cross-checked against GnuCash and others)
-  and capability parity with the old
-  GSheet+GDrive workflow — no SaaS subscription required.
+1. **The installed app: the destination (D-56, owner 2026-10-28).**
+   P11a: the platform groundwork first (the macOS and Windows keyring
+   stores, the Windows data root and pipes, a macOS and Windows CI
+   build; today the agent path works on Linux only), then the
+   cargo-packager trial, `wanderbooks update` and `rollback`, the Linux
+   packages (AUR, apt, dnf, AppImage), signing, the `.dmg` and the
+   per-user Windows installer, updates staged and applied at restart
+   (D-19, D-22, D-24 to D-26). Then P11b: the agent dock (Claude Code or
+   Codex in a terminal along the bottom of the viewer) and books homes
+   (D-27). "One app, one executable, separate processes."
+2. **The agent surface and the re-audit.** P4 (draft states, one
+   evidence gate, the preview digest, the digest tool), P5 (the result
+   envelope, prompts, `books.start` v2, journal history, agent evals),
+   P8 (audit and attestations), P10 (the owner's full re-audit of the
+   first company's books through the MCP alone). P13 (bookspec, the
+   formal accounting specification: steps 4 to 6, the spec text, the
+   spec's own checker, the GnuCash adapter) runs beside. P12 (the whole
+   max-testing pass again: mutation, fuzzing, full property runs, proofs)
+   comes last, over everything.
+
+## And then beyond
+
+Self-host for the owner is built (P9a: a system unit, the move with the
+head check, a static bearer over a tunnel). What follows the installed
+app, in order of the plan's decisions: claude.ai and ChatGPT reaching a
+self-hosted server through an external identity provider (P9b, after
+Q-6); then the paid, multi-tenant hosted service `plan/served.md` section
+11 describes and does not build (per-tenant processes, client-side vault
+unwrap before any paid launch, a browser viewer, email-in, invitations).
+The design is kept compatible with it at every step.
 
 ## Explicitly not on the roadmap
 
-Bank feeds, payment processing, payroll, tax filing. Those are integrations
-and regulated domains, not cloning targets. The engine gets clean seams for
-them; someone else's API provides them.
+Bank feeds, payment processing, payroll tax tables and filing, tax
+filing. Those are integrations and regulated domains, not cloning
+targets. The engine gets clean seams for them; someone else's API
+provides them. Budgets were declined as bloat (R-FUTURE-6).