P1: the books keep how they are kept

Settings, conventions (posting templates, approval rules, policies,
close steps, calendar, mappings, notes), decisions, open items and
entry approvals are journal events (journal format 2). Books that keep
their settings never read wanderbooks.toml or config.json; the server
and the viewer take the vault key from --vault-key-file instead.
books.import_settings moves a settings file in once, exactly as the
server reads it. Approval rules, when enforced, gate every posting
path. Replay refuses what it can't read as newer, never as corrupt.

Lean: a record changes no figure. Mutation on the whole diff: every
survivor killed by a test but two equivalent (docs/testing.md). The
Company page says a late open item is overdue in words, not colour
alone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj

docs/architecture.md

@@ -104,6 +104,23 @@ every complete line before it changes anything: a torn tail is set aside
 only when the gate passes, so an older version never alters newer books.
 Rule: `docs/spec/rules.md` B-27.
 
+## How the books are kept, in the books (P1)
+
+Settings, conventions, decisions, open items and approvals are journaled
+(journal format 2, declared with `journal.format_set` before the first
+such line, so a P0 reader stops there with "update wanderbooks"). The
+engine keeps them beside the ledger (`ledger_core::settings::Settings`,
+`ledger_core::conventions::Conventions`, fields of `Ledger`), so the store,
+its replay and the viewer's `Snapshot` share one reading; `Ledger::
+differs_from` and `verify` compare them, and the projection has a table
+for each (schema v12). `ledger-config` is the codec between them and a
+`wanderbooks.toml` (`codec::import`, `codec::export`) and still reads the
+file for books that predate P1 (the "file" source, until
+`books.import_settings`). The server (`settings::Live`) takes the books'
+settings whenever their last `settings.set` changes (on every lock of the
+store) and then never reads a file; "today" is the company's time zone's,
+set per request. Rule: `docs/spec/rules.md` B-29.
+
 ## The MCP server's store lock (`ledger-mcp`, P0)
 
 One `Store` is shared by every session (`SharedStore`: a