feat(arap)!: documents read their figures from standing lines; control accounts

refuse hand entries (P4b S1, part A)

Plan P4b (D-45), slice S1, the engine half: rules.md B-38.

- ledger-core: every receivables or payables line carries its document
  (Ledger.line_docs: DocRef, Movement, DocTag), written by the document
  commands in the step that posts it, derived on replay from the existing
  document events (the role's account as it stood then; payments by the
  ordinal rule), copied onto a reversal's mirror. Ledger::stands_on;
  doc_state / invoice_state / bill_state (total, paid, outstanding,
  status Open/Partial/Paid/WrittenOff/Void, overdue days) as of any day;
  ar_aging / ap_aging read them, so reversed payments and voids are right.
  The control guard (add_line, add_line_fx, post_entry,
  register_recurring) refuses untagged lines on receivables/payables,
  exempting a reversal's mirror of a legacy line; replay never refuses.
  Bounds (kernel::running_bounds, bounds_kept) on payments and reversals;
  a document reversal never dated before its entry; deposit/payer accounts
  must be cash-like and hold no role. New API: receive_payment_with /
  pay_bill_with (PaymentDetails: instrument, reference), void_document /
  check_void_document, control_check, payments_recorded,
  standing_payments, replay_reverse_entry. Invoice.amount_paid/status
  remain only as derived caches for the MCP layer until part B.
  cashflow bill_splits reads payments from the tags.
- ledger-store: journal feature document_standing (D-39 gated) for a
  payment accepted only because an earlier one was reversed;
  receive_payment_with / pay_bill_with (instrument journaled as
  entry.instrument_set, reference in the description), void_document;
  replay uses replay_reverse_entry; schema 15 drops the projection's
  amount_paid/status. Fixture p4-arap-before + golden figures written by
  the version before S1, adjudicated in arap_standing.rs.
- ledger-gui: party card, cash "coming up" and company owed totals read
  doc_state as of today (late from the derived state).
- Lean Documents.lean (control_agrees and friends); Kani
  bounds_check_matches_definition,
bounds_kept_is_the_definition_on_books_in_bounds;
  rules B-38, B-18/B-23 amended; bookspec `older = true` for legacy hand
  lines; tests that hand-post to 1200/2000 post as replay or renumbered.

Review fixes (both reviews of part A):
- control_role_of guards only an account the role is assigned to or one
  holding its documents' lines (a chart's own 1200 Equipment or card at
  2000 is free until a document posts there); payment accounts check
  other roles by holds_role (type-checked). The MCP tests that failed on
  the guard (oracle_mcp, spec_projects) pass unchanged.
- standing_payments leaves out reversals (sorted, deduped); replayed
  tags match the movement's side; payments_recorded counts every payment
  event (tagged or not, Ledger.payment_events) and refuses overflow.
- The record caches settled (paid + discounted + written off) and owed
  (Invoice/Bill.owed, never serialized): a void never reads as paid.
- assign_role: receivables/payables refuse moving onto an account with
  untagged lines (RoleAccountHasHandLines) and, on their control account
  holding a balance, say DocumentRoleHoldsBalance (no hand entry named);
  B-23 reworded. The reversal-mirror exemption only takes a hand line
  off (even chain depth); putting it back is refused.
- DocStatus Overpaid and Unattached; aging leaves out credit balances;
  ControlCheck.attention lists out-of-bounds and unattached documents.
- stands_on counts a chain in order; indexes (doc_index, doc_accounts,
  order_pos, reversed_by) keep the derived figures linear.
- Viewer reads a post-dated document as of its own date; one state per
  row. bounds_kept's side-crossing documented as intended.
- Tests: ten new spec_documents scenarios, stronger proptests, store
  proptest arap_props (live = replay = snapshot at every date, closed
  months), fuzz ops void/payments with details, a GUI post-dated test;
  Lean Step.assign / Step.release with unattached_zero kept; model
  limits stated in docs/testing.md and B-38.
Review fixes (CPA and engineering lenses): only an assigned role's
account or one holding document lines is a control account (a chart's
own 1200 asset stays free); a role can't move onto untagged lines or off
document lines (Lean Step.assign); a void's cache never reads as paid;
no Decimal sum panics; per-document indexes keep figures linear; a
replayed tag matches its side; the feature gate counts payment events;
a payment's reversal is never listed as standing; an overpaid document
has its own status; the viewer keeps post-dated documents.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj

crates/ledger-core/tests/statements.rs

@@ -9,9 +9,9 @@
 //! | Jan 2  | owner contributes 10,000      | 1000 Cash     | 3000 Capital  |
 //! | Jan 15 | client pays 2,500             | 1000 Cash     | 4000 Revenue  |
 //! | Jan 20 | rent 800                      | 6100 Rent     | 1000 Cash     |
-//! | Feb 3  | software 120 on the card      | 6000 Software | 2000 Card     |
+//! | Feb 3  | software 120 on the card      | 6000 Software | 2050 Card     |
 //! | Feb 10 | client pays 1,000             | 1000 Cash     | 4000 Revenue  |
-//! | Feb 25 | pay the card 120              | 2000 Card     | 1000 Cash     |
+//! | Feb 25 | pay the card 120              | 2050 Card     | 1000 Cash     |
 
 use chrono::NaiveDate;
 use ledger_core::reports::{
@@ -57,7 +57,7 @@ fn books(close_january: bool) -> Books {
         .add_account("1000", "Cash", AccountType::Asset, None, false)
         .unwrap();
     let card = l
-        .add_account("2000", "Card", AccountType::Liability, None, false)
+        .add_account("2050", "Card", AccountType::Liability, None, false)
         .unwrap();
     let capital = l
         .add_account("3000", "Capital", AccountType::Equity, None, false)
@@ -160,7 +160,7 @@ fn balance_sheet_is_as_of_the_date() {
     // Feb 15: cash 12,700; the card owes 120; earnings 1,700 + 880.
     let mid = balance_sheet_as_of(&b.ledger, d(2, 15)).unwrap();
     assert_eq!(mid.total_assets, dec(12_700));
-    assert_eq!(mid.liabilities, vec![line("2000", "Card", 120)]);
+    assert_eq!(mid.liabilities, vec![line("2050", "Card", 120)]);
     assert_eq!(mid.current_earnings, dec(2_580));
     assert_eq!(mid.total_liabilities + mid.total_equity, dec(12_700));
 
@@ -307,7 +307,7 @@ fn general_ledger_runs_balances_by_account() {
     let gl = general_ledger(&b.ledger, d(2, 1), d(2, 28)).unwrap();
     let codes: Vec<&str> = gl.accounts.iter().map(|a| a.code.as_str()).collect();
     // Every account with a beginning balance or February activity, by code.
-    assert_eq!(codes, ["1000", "2000", "3000", "4000", "6000", "6100"]);
+    assert_eq!(codes, ["1000", "2050", "3000", "4000", "6000", "6100"]);
 
     let cash = &gl.accounts[0];
     assert_eq!(cash.beginning_balance, dec(11_700));
@@ -320,7 +320,7 @@ fn general_ledger_runs_balances_by_account() {
         p,
         [
             (dec(1_000), dec(0), "4000 Revenue", dec(12_700)),
-            (dec(0), dec(120), "2000 Card", dec(12_580)),
+            (dec(0), dec(120), "2050 Card", dec(12_580)),
         ]
     );
     assert_eq!(cash.ending_balance, dec(12_580));
@@ -354,7 +354,7 @@ fn general_ledger_marks_compound_entries_as_split() {
         .add_account("1000", "Cash", AccountType::Asset, None, false)
         .unwrap();
     let card = l
-        .add_account("2000", "Card", AccountType::Liability, None, false)
+        .add_account("2050", "Card", AccountType::Liability, None, false)
         .unwrap();
     let soft = l
         .add_account("6000", "Software", AccountType::Expense, None, false)
@@ -373,7 +373,7 @@ fn general_ledger_marks_compound_entries_as_split() {
     // The debit side has two other accounts; each credit has one.
     assert_eq!(split_of("6000"), ("-Split-".to_string(), e));
     assert_eq!(split_of("1000"), ("6000 Software".to_string(), e));
-    assert_eq!(split_of("2000"), ("6000 Software".to_string(), e));
+    assert_eq!(split_of("2050"), ("6000 Software".to_string(), e));
 }
 
 /// Two members, 50/50: Alice and Bob. January: Alice puts in 600, Bob 400;
@@ -1087,7 +1087,7 @@ fn cash_flow_labels_say_which_way_each_balance_moved() {
         .add_account("1100", "Receivable", AccountType::Asset, None, false)
         .unwrap();
     let ap = l
-        .add_account("2000", "Payable", AccountType::Liability, None, false)
+        .add_account("2010", "Payable", AccountType::Liability, None, false)
         .unwrap();
     let loan = l
         .add_account("2500", "Loan", AccountType::Liability, None, false)
@@ -1144,7 +1144,7 @@ fn cash_flow_labels_say_which_way_each_balance_moved() {
         rec(&feb),
         [
             (s("Increase in 1100 Receivable"), dec(-100)),
-            (s("Increase in 2000 Payable"), dec(50)),
+            (s("Increase in 2010 Payable"), dec(50)),
         ]
     );
     assert_eq!(
@@ -1167,7 +1167,7 @@ fn cash_flow_labels_say_which_way_each_balance_moved() {
         rec(&mar),
         [
             (s("Decrease in 1100 Receivable"), dec(100)),
-            (s("Decrease in 2000 Payable"), dec(-50)),
+            (s("Decrease in 2010 Payable"), dec(-50)),
         ]
     );
     assert_eq!(