P1: the books keep how they are kept

Settings, conventions (posting templates, approval rules, policies,
close steps, calendar, mappings, notes), decisions, open items and
entry approvals are journal events (journal format 2). Books that keep
their settings never read wanderbooks.toml or config.json; the server
and the viewer take the vault key from --vault-key-file instead.
books.import_settings moves a settings file in once, exactly as the
server reads it. Approval rules, when enforced, gate every posting
path. Replay refuses what it can't read as newer, never as corrupt.

Lean: a record changes no figure. Mutation on the whole diff: every
survivor killed by a test but two equivalent (docs/testing.md). The
Company page says a late open item is overdue in words, not colour
alone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj

plan/STATUS.md

@@ -1,6 +1,6 @@
-# STATUS — 2026-10-17: "Served" P0 landed and live; P1 next
+# STATUS — 2026-10-17: "Served" P0 live; P1 landed, cutover next
 
-## Now: Served (plan/served.md), P0 done, P1 next
+## Now: Served (plan/served.md), P0 live, P1 landed
 
 The 2026-10-16 audit of the first company's books (62 verified findings,
 20 engine defects) and the design discussion that followed produced
@@ -29,6 +29,18 @@ Cutover on the first company's books, 2026-10-17: `books.verify` ok
 books dir, `goldens/p0-cutover-2026-10-17/`). Connect text with their
 settings: 1,396 characters.
 
+**P1 (journal-native settings and conventions): landed.** Settings,
+conventions (posting templates, approval rules, policies, close steps,
+calendar, mappings, notes), decisions, open items and approvals are
+journal events (format 2); books that keep their settings never read
+`wanderbooks.toml` or `config.json`, and `books.import_settings` moves a
+file in exactly once. Two review rounds (all findings fixed), `just
+check`, `just prove` (Kani 20/20, Lean 31 theorems, standard axioms
+only), and mutation on the whole diff (956 mutants; every survivor
+killed by a test but two equivalent: `docs/testing.md`). **Next:** the
+first company's cutover (goldens before and after, import, time zone,
+conventions from its AGENTS.md), then P2.
+
 **Before-snapshots for later phases:** the first company's reports as of
 2026-10-11 and 2026-10-16 (journal head `d1ccd2fd…`, 355 events) are
 saved in that books dir under `goldens/p0-2026-10-16/` (exported through
@@ -36,7 +48,7 @@ the MCP, no TINs), privately, by decision, never in this public repo
 (plan 5.6). P1+ must reproduce them except where the P3 change log
 adjudicates a difference (cash flow, defect 1).
 
-**Then:** P1 (journal-native settings and conventions), P2 (serve locally,
+**Then:** P2 (serve locally,
 cutover; ask the owner the three plain-English cutover questions in
 plan section 10.3 first), P3-P11 as planned (P11, added 2026-10-17: one app for Windows, Mac and
 Linux; P2 gained backup restore and the viewer's menu).

plan/served.md

@@ -743,6 +743,18 @@ The first company keeps working between phases.
 - The GUI is correct with the toml renamed away.
 - `books.start` v1 is at most 8 KB.
 
+**As built (2026-10-17), and where it departs from the scope above (engineering calls):**
+- One event per change set: `settings.set {changes: [{key, value|null}], source}` is all or nothing (an import is one line); there is no separate `settings.cleared` (a null value clears). `effective_from` is not built: no key needs it yet, and effective-dated members are the varying-interest rule (§706(d)), which changes figures and belongs with the P3 allocation work. A later format adds it.
+- Keys are flat (`company.formation_state`, `company.irs_name_control`, ...), not one `company.legal{}` object: each fact gets its own source, which is what "facts carry their source" asks. `company.members` keeps member names (matched to parties as before); `company.cpa` is text. `policy.capitalization`, `require_tax_category`, `attestation_bar`, `cpa_package_requires_audit`, `audit_cadence` and `books.schedule_convention` arrive with the phases that use them (P3, P8).
+- `ledger-view` (`attention::find` moved out of the viewer) moves to P5, where its first user (`books.start`'s needs_attention, `next_steps`) lands; P1 has no server-side consumer, and moving 700 lines of the viewer for nothing would be risk without use. `attention_server_equals_gui` goes with it.
+- The "due to" heuristic keeps reading account names: `financing_accounts` also holds bank loans, which aren't "paid personally".
+- Approval rules are checked by the engine (`Ledger::approvals_missing`) and enforced by the store: `Store::post_entry` refuses a covered draft until approved, and the operations that post at once (invoices, bills, payments, payroll, remittances, disposals) are refused when a rule covers the entry they would post (`approval_gate`: draft it instead). Reversals, closes, depreciation and amortization are exempt. An approval records the draft's fingerprint (date, description, lines, classes); any change voids it. A rule names accounts that take postings, and an account a rule names can't be renumbered until the rule is revised.
+- `books.import_settings` takes only the file the server reads, whole (compared key by key with the server's own reading), never turns approval rules on, and on books that keep their own settings changes nothing (review round 1: an agent-transcribed text could drop the EIN).
+- `books.start` v1 leaves `book.id`, `book.url`, `head.last_handoff`, the `agent` input and `alwaysLoad` for P5 (they need the served book identity and tool search).
+- Posting templates take slots (`{expense}`): an account each draft names, so "an expense a member paid: Dr <expense> / Cr 2100" is one template.
+- A vault key file is never a books setting: `--vault-key-file` on the server and the viewer, and an import is refused unless the key in force stays the same.
+- The connect text's lead names `books.start` first, then the handbook.
+
 ### P2: Serve locally, hidden away, and the the first company cutover
 
 **Scope:**