refactor!: files only by handle: uploads in, downloads out (D-46)

The owner (2026-10-23, via the question tool): "Uploads only"; and
before it: "What we would DEFINITELY want to avoid is passing a bunch
of BLOBs through AI context windows. That's just a pure waste." No file
passes through an agent's context, in either direction.

In: the inline arguments are gone with the 256 KiB limit (INLINE_MAX,
take_file's inline branch): content_base64 and its sha256 on
books.attach_receipt and books.file_document, w9_content_base64 and
w9_sha256 on books.set_w9, csv_text on the two CSV imports. A file comes
only by books.begin_upload and `wanderbooks upload`, named by its
upload_id; existing_attachment_id still names bytes stored already. The
five filing tools deny unknown fields, and any inline argument to any
tool is refused before it runs as an unknown argument pointing to
books.begin_upload (access log: refused inline_file).

Out: books.export (every format), books.asset_labels and
books.get_receipt view bytes hand the file over (HandedFile: download
command and expiry, D-29), as the CPA package and the W-9 do. Resource
reads stay text. A token keeps up to 64 handed files (was 16). The
access log's digest no longer exempts file bytes.

Docs: handbook files-in-out and parties-and-tins, mcp-interface.md,
rules.md, receipt-store.md, parties-and-attachments.md, plan/served.md
(D-46; the inline decisions marked superseded), STATUS.md, testing.md
(D-46: tests migrated to uploads and downloads, rewritten, removed,
added).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj

crates/ledger-store/src/access.rs

@@ -122,18 +122,14 @@ pub fn asserted(text: &str) -> String {
 /// books show is found among 10^5 guesses (review of slice 4). Masked:
 /// any value under a key naming a TIN; any key or text holding one; any
 /// number of eight digits or more (whatever its sign or fraction: a TIN
-/// may start with a zero). A file's base64 bytes are hashed as they are:
-/// base64 never spells a TIN in the clear, and scanning megabytes of it
-/// costs more than it could protect.
+/// may start with a zero). No argument is a file's bytes (D-46: files
+/// come by upload), so every text is scanned.
 pub fn digest(args: &Value) -> String {
-    sha256_hex(canonical_json(&masked(args, false)).as_bytes())
+    sha256_hex(canonical_json(&masked(args)).as_bytes())
 }
 
-/// Keys whose values are a file's bytes, base64 (see [`digest`]).
-const FILE_BYTES: [&str; 2] = ["content_base64", "w9_content_base64"];
-
-/// `v` with every TIN masked (see [`digest`]); `bytes`: a file's base64.
-fn masked(v: &Value, bytes: bool) -> Value {
+/// `v` with every TIN masked (see [`digest`]).
+fn masked(v: &Value) -> Value {
     const MASK: &str = "[TIN]";
     match v {
         Value::Object(map) => Value::Object(
@@ -148,14 +144,13 @@ fn masked(v: &Value, bytes: bool) -> Value {
                     let v = if names_a_tin && !v.is_null() {
                         Value::from(MASK)
                     } else {
-                        masked(v, FILE_BYTES.contains(&k_lower.as_str()))
+                        masked(v)
                     };
                     (ledger_core::parties::redact_full_tins(k).into_owned(), v)
                 })
                 .collect(),
         ),
-        Value::Array(items) => Value::Array(items.iter().map(|v| masked(v, false)).collect()),
-        Value::String(_) if bytes => v.clone(),
+        Value::Array(items) => Value::Array(items.iter().map(masked).collect()),
         Value::String(s) => Value::from(ledger_core::parties::redact_full_tins(s).into_owned()),
         Value::Number(n) if n.as_f64().is_none_or(|f| f.abs() >= 1e7) => Value::from(MASK),
         other => other.clone(),
@@ -397,10 +392,10 @@ mod tests {
             digest(&serde_json::json!({"entry_id": 1234567})),
             digest(&serde_json::json!({"entry_id": 1234568}))
         );
-        // A file's bytes count as they are.
+        // Text with no TIN in it counts as it is.
         assert_ne!(
-            digest(&serde_json::json!({"content_base64": "MTIzNDU2Nzg5"})),
-            digest(&serde_json::json!({"content_base64": "OTg3NjU0MzIx"}))
+            digest(&serde_json::json!({"upload_id": "up_MTIzNDU2Nzg5"})),
+            digest(&serde_json::json!({"upload_id": "up_OTg3NjU0MzIx"}))
         );
     }
 
@@ -442,21 +437,16 @@ mod tests {
     }
 
     #[test]
-    fn a_files_bytes_are_hashed_as_they_are_even_where_they_spell_digits() {
-        // Base64 can hold a run of nine digits; it is still a file's bytes,
-        // not a TIN, and two files differing there differ.
-        for key in FILE_BYTES {
-            assert_ne!(
+    fn digits_inside_any_text_are_masked() {
+        // No argument is a file's bytes any more (D-46): a run of nine
+        // digits is masked wherever it is, under any key.
+        for key in ["memo", "description", "upload_id"] {
+            assert_eq!(
                 digest(&serde_json::json!({ key: "QUJD123456789QUJD" })),
                 digest(&serde_json::json!({ key: "QUJD987814321QUJD" })),
                 "{key}"
             );
         }
-        // The same text anywhere else is masked.
-        assert_eq!(
-            digest(&serde_json::json!({"memo": "QUJD123456789QUJD"})),
-            digest(&serde_json::json!({"memo": "QUJD987814321QUJD"}))
-        );
     }
 
     #[test]

crates/ledger-store/src/exports.rs

@@ -1,7 +1,7 @@
-//! Files on their way out (plan 4.7, D-29): a file the server makes for an
-//! agent (the CPA package, the 1099 worksheet, a W-9) is kept here a
-//! while, for the token that asked for it, until `wanderbooks download`
-//! fetches it.
+//! Files on their way out (plan 4.7, D-29, D-46): a file the server hands
+//! an agent (the CPA package, the 1099 worksheet, a W-9, a report export,
+//! a label sheet, a receipt's copy) is kept here a while, for the token
+//! that asked for it, until `wanderbooks download` fetches it.
 //!
 //! ```text
 //! GOAL: an agent hands the human a file of any size the books make,
@@ -9,7 +9,8 @@
 //!       path on the server.
 //! SOURCE: plan 4.7 (`download_link`: "valid 10 minutes, access-logged");
 //!         D-29 ("their files are made by the server and handed over by a
-//!         command, `wanderbooks download`").
+//!         command, `wanderbooks download`"); D-46 ("files never pass
+//!         through an agent's context, in either direction").
 //! INVARIANTS:
 //!   1. An export is kept for one token, under an id of no digits (the
 //!      access log masks what could be a TIN), and lasts EXPORT_TTL; only
@@ -32,8 +33,10 @@ use std::path::{Path, PathBuf};
 pub const EXPORTS_DIR: &str = "exports";
 /// How long an export is kept, seconds.
 pub const EXPORT_TTL: i64 = 15 * 60;
-/// The most exports one token may have kept at once (INVARIANT 3).
-pub const MAX_LIVE: usize = 16;
+/// The most exports one token may have kept at once (INVARIANT 3): every
+/// file an agent takes away is one since D-46 (each report it exports,
+/// each receipt it reads back), so a month-end's worth fits.
+pub const MAX_LIVE: usize = 64;
 
 /// What an export is (INVARIANT 1): its bytes are beside it.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]