P1: the books keep how they are kept

Settings, conventions (posting templates, approval rules, policies,
close steps, calendar, mappings, notes), decisions, open items and
entry approvals are journal events (journal format 2). Books that keep
their settings never read wanderbooks.toml or config.json; the server
and the viewer take the vault key from --vault-key-file instead.
books.import_settings moves a settings file in once, exactly as the
server reads it. Approval rules, when enforced, gate every posting
path. Replay refuses what it can't read as newer, never as corrupt.

Lean: a record changes no figure. Mutation on the whole diff: every
survivor killed by a test but two equivalent (docs/testing.md). The
Company page says a late open item is overdue in words, not colour
alone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj

docs/verification.md

@@ -87,7 +87,9 @@ Each law, and what proves it. Kani harnesses are in
 ### The books over time
 
 The Lean model (`Ledger.lean`) describes the engine as a state machine:
-add an account, start a draft, post, reverse, open a period, close one.
+add an account, start a draft, post, reverse, open a period, close one,
+and record how the books are kept (a setting, convention, decision, open
+item or approval: one step, `record`, each record abstracted to a number).
 Each step carries the checks the engine makes before it mutates. These
 theorems hold in **every state reachable from empty books, by any
 sequence of commands, of any length**:
@@ -106,6 +108,18 @@ sequence of commands, of any length**:
     commands adds, removes, or changes an entry dated in it, and it stays
     closed.
     - Lean `Step.frozen`, `Steps.frozen`
+13a. **How the books are kept changes no entry**: in the model, a record
+    (a setting, convention, decision, open item or approval) leaves the
+    chart, every posted entry, every draft and every period exactly as they
+    were, and any number of them keeps a reachable state reachable. The
+    model's `record` step touches only the records by definition, so the
+    proof says the model is sound, not the engine; the engine's side is
+    checked by `settings_replay_is_pure`, which snapshots every figure and
+    entry around each record (rules.md B-29). Settings that change how the
+    same entries are presented (the fiscal year, cash flow roles, members)
+    are outside this law by design.
+    - Lean `Step.record_changes_no_figure`, `Reachable.records` (no
+      axioms at all) · property `settings_replay_is_pure`
 
 ### Closing