docs: the paused wave has landed; D-60, how much checking a merge gets; Q-9

The plan and the status documents say what is true after the merges
of 2026-10-29: served.md section 0, the 8.0.1 rows and unit Status
lines for S4.4, S5, S6, S7 and P6 (landed, with commits), the 8.0.2
resume paragraph turned into the record of what the merges found,
P6's At-merge bullet (the write-off and dedup interaction, the five
tests its interrupted gate never reached, schema 18), P9a's Done-when 1
verified by the green two-user job, D-58 and D-59 in order.

D-60 (the owner): per merge a compile and the unit's own tests; the
exhaustive gates once per batch, at the end. AGENTS.md's two gate
sentences, HANDOFF.md's merging procedure and the plan carry it, with
the reason: five full gates around five merges took twelve hours and
the one gate at the end found the same five tests.

Q-9 (open, for the owner): P6's `ledger-store` -> `ledger-import`
dependency, with the options and the recommendation; architecture.md
marks the arrow as under review. testing.md records the merge's test
changes under P6. STATUS.md gains "Now (2026-10-29)" with the gate
figures (170 suites, 2,944 tests, 77 minutes), the CI state and the
next steps; HANDOFF.md, roadmap.md, gui.md and the parties doc drop
the paused-branch wording; README counts 129 tools and about 2,950
tests.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp

docs/architecture.md

@@ -31,7 +31,7 @@ the specification in `bookspec/` (which never depends on the engine).
 | `ledger-core` | the semantics engine: money, chart, journal, `Ledger` commands, reports, periods, assets, schedules, parties, A/R and A/P, payroll, projects, settings and conventions, the kernel and its Kani harnesses | nothing |
 | `ledger-vault` | the TIN vault: XChaCha20-Poly1305 records under the book's key | nothing |
 | `ledger-config` | the `wanderbooks.toml` codec (adoption in, `books.export_settings` out) and the receipt policy until P4 moves it into the core | `ledger-core` |
-| `ledger-store` | the source of truth: the hash-chained JSONL journal, its format gate, the SQLite projection (schema 16; a file per schema), the blob store, backups, the access log, `Snapshot` for readers | `ledger-core` |
+| `ledger-store` | the source of truth: the hash-chained JSONL journal, its format gate, the SQLite projection (schema 18; a file per schema), the blob store, backups, the access log, `Snapshot` for readers | `ledger-core`, `ledger-import` (the file reader, P6; Q-9) |
 | `ledger-import` | formats: QuickBooks CSV in; IIF, XLSX, Typst PDFs (statements, the invoice, labels) out | `ledger-core` |
 | `ledger-package` | the shared read-only view over `Store` or `Snapshot` (`PackageBooks`): the CPA package, the 1099 worksheet, the invoice document, Needs attention | `ledger-core`, `ledger-store`, `ledger-config`, `ledger-import`, `ledger-vault` |
 | `ledger-mcp` | the books server: the MCP tools (122), resources, the handbook, scopes, the door and the access log, backups' scheduling | all of the above |
@@ -50,12 +50,14 @@ test `crates/ledger-core/tests/oracle_gnucash.rs` with `oracle/gnucash/`
 (`PackageBooks` is the shared view; extraction is in-process in
 `ledger-import`, P6).
 
-Pending (the P6 branch, 2026-10-27, unmerged): P6 made `ledger-store`
-depend on `ledger-import` so the writer can extract a file's text at
-attach time and on the backfill command. That keeps the direction inward
-but pulls Typst, the fonts and hayro into the store's dependency closure;
-whether it stands, or extraction moves to the server before the store
-call, is decided at P6's review.
+Under review (Q-9, asked 2026-10-29 when P6 landed): P6 made
+`ledger-store` depend on `ledger-import` so the writer can extract a
+file's text at attach time and on the backfill command. That keeps the
+direction inward (`ledger-import` depends on the core alone and must
+never depend on the store) but pulls Typst, the fonts and hayro into the
+store's dependency closure. The plan's recommendation is a small library
+crate holding the reader that both depend on; until the owner decides,
+the arrow stands as drawn above.
 
 `ledger-core` itself (`crates/ledger-core/src/`): `money`, `account`,
 `journal`, `ledger` (the command surface and replay), `kernel` (every
@@ -128,7 +130,7 @@ and version; `Store::verify` checks the text blob's hash and never
 re-derives it. The server's filing scan (`tin_files`) and the viewer's PDF
 rasterizer read through the same module, so a PDF's text is read one way.
 Annotations and settlements are ledger state (`ledger_core::evidence`,
-`Ledger::differs_from`), projected into schema 16's `annotations` table;
+`Ledger::differs_from`), projected into schema 18's `annotations` table;
 extractions have a table of their own. The viewer's Documents page groups
 by category and filters by subject; Needs attention reads both through
 `PackageBooks`.
@@ -165,7 +167,7 @@ engine keeps them beside the ledger (`ledger_core::settings::Settings`,
 `ledger_core::conventions::Conventions`, fields of `Ledger`), so the store,
 its replay and the viewer's `Snapshot` share one reading; `Ledger::
 differs_from` and `verify` compare them, and the projection has a table
-for each (schema 16 on 2026-10-28; a file per schema). `ledger-config` is the codec between them and a
+for each (schema 18 on 2026-10-29; a file per schema). `ledger-config` is the codec between them and a
 `wanderbooks.toml` (`codec::import`, `codec::export`): adoption (`wanderbooks
 books adopt`) moves an older books dir's file in through it, once, and
 `books.export_settings` writes the books' settings out as one. The books

docs/parties-and-attachments.md

@@ -4,7 +4,8 @@ Design for two features built together (the owner, 2026-10-15): a directory
 of the parties the company deals with, and attachments that link to any
 subject. Status: built (2026-10-15 to 2026-10-17: parties with roles, the
 TIN vault, attachments linked to any subject; the party's contact block,
-D-55, is built on branch S4.4 as of 2026-10-28). The design is kept as
+D-55, landed with P4b S4.4 on 2026-10-29; the same bytes filed twice are
+one attachment since P6, the same day). The design is kept as
 written; departures are in `plan/served.md` and `docs/spec/rules.md` B-26.
 
 ## Why together

docs/testing.md

@@ -3354,6 +3354,30 @@ use in `ledger-gui` or `ledger-mcp` (the extract crate is the only one);
 backfill command test; (5) the PR carries the 8.0.6 checklist; (6)
 `just check` green and both fuzz targets run ten minutes clean.
 
+**At merge (2026-10-29, `9351f89d`, `bfd453b6`).** The branch's gate had
+been interrupted, so the merge ran it to the end for the first time.
+Five tests from before P6 still encoded the invariant its step 4
+replaced, or counts from before extraction records existed, and were
+brought to the new rule rather than the rule to them:
+`blob_dedup_and_hash_verification` expects one attachment row under the
+first filing's name; `power_loss_at_any_byte_of_the_last_append_is_recovered`
+copies `blobs/` with the journal and the database, since `verify` now
+reads an extraction's text blob; `refused_commands_never_reach_the_journal`
+allows `AttachReceipt` and `FileDocument` to journal nothing when the
+bytes are already on file; the viewer's reconciliation helper files each
+statement with its own bytes; and the tall sidebar's shapes golden
+(`crates/ledger-gui/tests/goldens/sidenav-1440x920.shapes`, re-blessed
+with `SIDENAV_BLESS=1`) carries the fixture's new attention, event and
+file counts, no layout change. One interaction with S7 was a defect, not
+a test: `write_off_invoice` attached its notice after journaling the
+entry, so a notice whose bytes were already on file and linked to
+another entry was refused by the one-receipt-one-entry rule after the
+money had moved; the store now runs `check_linkable` on the
+deduplicated record before the journal line, and
+`a_write_off_whose_notice_is_anothers_receipt_is_refused_before_posting`
+(`tests/arap_standing.rs`) pins it. The bookspec adapter and the old-books
+fixture file each write-off's notice with its own bytes.
+
 **For P12 (mutation targets, none run, D-33):** `ledger-import::extract`:
 the caps' comparisons (`MAX_BYTES`, `MAX_PAGES`, `MAX_TEXT_BYTES`, the
 `cap_text` boundary walk), `extract`'s order (PDF by type or magic, XLSX