P2: tests mutation found, three bugs fixed; plan P12 and P13

Mutation testing pauses until P12 (D-33, owner 2026-10-20), which reruns
the whole max-testing pass over everything since P1. Before the pause,
pass 1 on slices 3-6 and its triage gave tests in ledger-store,
ledger-package and ledger-mcp, and three real bugs, fixed:
- the command line took an admin answer longer than four MiB, or cut off
  before its newline, whenever the bytes that came still parsed;
- The CPA package put a twin's number on the last dot of the whole path,
  so in a folder with a dot the second file landed in another folder;
- a document or category named of dots alone ("..") could climb out of
  its folder when the CPA package is unpacked.
The plan gains P13, bookspec (D-34): a formal, sourced accounting
specification first (rules with symbolic forms and worked examples), then
its own formal validation and a conformance harness any engine can be
tested against, seeded by P3's regression tests. docs/testing.md records
slices 3-8 and what P12 must cover; plan/STATUS.md says where P2 stands.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj

crates/ledger-store/src/root.rs

@@ -1711,4 +1711,29 @@ mod unit {
         let (_, login) = unix_account().unwrap();
         assert!(!login.is_empty());
     }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn a_folder_the_disk_wont_look_up_is_never_made_over() {
+        // The disk can't say what is under the name (an I/O error, where
+        // making the folder would go through): refused with the disk's
+        // own error, and no folder made over whatever is there.
+        let dir = tempfile::tempdir().unwrap();
+        let book = dir.path();
+        let Some(got) = crate::refuse::refusing(crate::refuse::LOOKUPS, libc::EIO, || {
+            private_book_folder(book, "keys")
+        }) else {
+            eprintln!("skipped: no seccomp here");
+            return;
+        };
+        let Err(RootError::Io(why, e)) = got else {
+            panic!("refused as an I/O error: {got:?}")
+        };
+        assert_eq!(e.raw_os_error(), Some(libc::EIO));
+        assert!(!why.contains(&book.display().to_string()), "{why}");
+        assert!(!book.join("keys").exists());
+        // Looked up as it should be: made, private.
+        let keys = private_book_folder(book, "keys").unwrap();
+        assert_eq!(keys, book.join("keys"));
+    }
 }