7 Commits

Include renames

Author	SHA1	Message	Date
swaits	13282cf80e	feat(arap): terms, numbers and line accounts in the core (P4b S4.1) ... Documents could name only one revenue or general-expenses account per project, had no number of their own, and took a due date the caller had to work out. This slice gives the core the pieces the rest of S4 needs, and journals nothing: an old-shape document still writes byte for byte, so the owner's books need no upgrade for it. - Payment terms (B-39): Net n, Net n EOM, due on receipt and a custom date, with the early-payment discount and its exact bound (kernel::discount_max, Kani + bridge). A due date past the calendar's end is refused, never a panic, and a discount is refused with terms that have no net days. - Invoice numbers (B-40, A-2): first_number plus the count of numbered invoices, zero-padded to four digits and wider past 9,999, stored at issue, kept by a void; legacy invoices are uncounted. - Line accounts (A-10): a document line may name its account, and the entry posts one line per (account, project) part. An invoice line takes revenue or a liability holding no role (deferred revenue); a bill line an expense or a non-cash asset holding no role. Roles, cash accounts and headers are refused. - A line's amount is exactly its quantity times its unit price (kernel::line_amount, Kani + bridge): both or neither, never rounded. - A vendor's invoice number names one standing bill per vendor, with case, spaces and hyphens ignored, unless a duplicate reason says why (B-40). - The record fields S4.3 will journal: number, terms, bill-to and seller snapshots, customer reference, memo, the empty sends list S5 fills, and the bill's received_on, all optional and defaulted. The store refuses a line carrying an account, quantity or unit price before it rehearses or journals anything: those fields are journaled from S4.3's documents_v2 on, and I-3 will not let a public write replay without them. `document_line_fields_wait_for_documents_v2` proves the refusal, the unchanged journal and allocators, and that an ordinary line journals exactly as before. S4.3 removes this guard in the same change that journals the fields and adds its byte-for-byte test. The document commands keep their signatures; create_invoice_with and create_bill_with take the optional fields for S4.3 and for tests. They are the existing issue commands with more fields, not a new state transition, so no Lean Step is added. Kani: line_amount_is_exact runs in `just prove`; discount_max_is_bounded relates a product to a quotient and runs in `prove-slow` (163 s), as the proration charge harnesses do. just check green; just prove green.	2026-10-27 00:02:51 -06:00
swaitsandClaude Opus 5.5	d7fa16e974	feat(arap)!: documents read their figures from standing lines; control accounts ... refuse hand entries (P4b S1, part A) Plan P4b (D-45), slice S1, the engine half: rules.md B-38. - ledger-core: every receivables or payables line carries its document (Ledger.line_docs: DocRef, Movement, DocTag), written by the document commands in the step that posts it, derived on replay from the existing document events (the role's account as it stood then; payments by the ordinal rule), copied onto a reversal's mirror. Ledger::stands_on; doc_state / invoice_state / bill_state (total, paid, outstanding, status Open/Partial/Paid/WrittenOff/Void, overdue days) as of any day; ar_aging / ap_aging read them, so reversed payments and voids are right. The control guard (add_line, add_line_fx, post_entry, register_recurring) refuses untagged lines on receivables/payables, exempting a reversal's mirror of a legacy line; replay never refuses. Bounds (kernel::running_bounds, bounds_kept) on payments and reversals; a document reversal never dated before its entry; deposit/payer accounts must be cash-like and hold no role. New API: receive_payment_with / pay_bill_with (PaymentDetails: instrument, reference), void_document / check_void_document, control_check, payments_recorded, standing_payments, replay_reverse_entry. Invoice.amount_paid/status remain only as derived caches for the MCP layer until part B. cashflow bill_splits reads payments from the tags. - ledger-store: journal feature document_standing (D-39 gated) for a payment accepted only because an earlier one was reversed; receive_payment_with / pay_bill_with (instrument journaled as entry.instrument_set, reference in the description), void_document; replay uses replay_reverse_entry; schema 15 drops the projection's amount_paid/status. Fixture p4-arap-before + golden figures written by the version before S1, adjudicated in arap_standing.rs. - ledger-gui: party card, cash "coming up" and company owed totals read doc_state as of today (late from the derived state). - Lean Documents.lean (control_agrees and friends); Kani bounds_check_matches_definition, bounds_kept_is_the_definition_on_books_in_bounds; rules B-38, B-18/B-23 amended; bookspec `older = true` for legacy hand lines; tests that hand-post to 1200/2000 post as replay or renumbered. Review fixes (both reviews of part A): - control_role_of guards only an account the role is assigned to or one holding its documents' lines (a chart's own 1200 Equipment or card at 2000 is free until a document posts there); payment accounts check other roles by holds_role (type-checked). The MCP tests that failed on the guard (oracle_mcp, spec_projects) pass unchanged. - standing_payments leaves out reversals (sorted, deduped); replayed tags match the movement's side; payments_recorded counts every payment event (tagged or not, Ledger.payment_events) and refuses overflow. - The record caches settled (paid + discounted + written off) and owed (Invoice/Bill.owed, never serialized): a void never reads as paid. - assign_role: receivables/payables refuse moving onto an account with untagged lines (RoleAccountHasHandLines) and, on their control account holding a balance, say DocumentRoleHoldsBalance (no hand entry named); B-23 reworded. The reversal-mirror exemption only takes a hand line off (even chain depth); putting it back is refused. - DocStatus Overpaid and Unattached; aging leaves out credit balances; ControlCheck.attention lists out-of-bounds and unattached documents. - stands_on counts a chain in order; indexes (doc_index, doc_accounts, order_pos, reversed_by) keep the derived figures linear. - Viewer reads a post-dated document as of its own date; one state per row. bounds_kept's side-crossing documented as intended. - Tests: ten new spec_documents scenarios, stronger proptests, store proptest arap_props (live = replay = snapshot at every date, closed months), fuzz ops void/payments with details, a GUI post-dated test; Lean Step.assign / Step.release with unattached_zero kept; model limits stated in docs/testing.md and B-38. Review fixes (CPA and engineering lenses): only an assigned role's account or one holding document lines is a control account (a chart's own 1200 asset stays free); a role can't move onto untagged lines or off document lines (Lean Step.assign); a void's cache never reads as paid; no Decimal sum panics; per-document indexes keep figures linear; a replayed tag matches its side; the feature gate counts payment events; a payment's reversal is never listed as standing; an overpaid document has its own status; the viewer keeps post-dated documents. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj	2026-10-24 09:17:42 -06:00
swaitsandClaude Opus 5.5	528c070605	feat: invoices and bills take a project, line by line (B-37 item 8) ... A client project's invoiced revenue and a contractor's billed cost could never count toward the project: books.create_invoice and books.create_bill posted at once with untagged lines, and only a draft's line takes a class. Job costing (B-37 item 3) collects a job's billings and the supplier invoices for its direct costs on its cost sheet, so each document line now takes an optional project. The owner decided it on 2026-10-22 (plan D-43, rules.md B-37 item 8): each line takes one project or none; a document spanning N projects is N lines, each with its own amount; no percentage split, so every figure is exact; a cost truly shared among projects names none on the document and reaches projects only as entries of their own under the company's monthly allocation convention, when books.conventions has one (otherwise it stays untagged and the agent asks the human). The reasoning, stated in B-37: job costing charges a job the costs traceable to it, whole, and reaches shared costs only by allocation on a stated basis. ASC 340-40-25-7 counts as directly related both the costs traceable to a contract (25-7(a), (b), (d), (e)) and allocations of costs that relate directly to it (25-7(c)); 25-8 expenses general and administrative cost. The books carry the first whole on the document's line and the second as the allocation convention's own entries; neither is a percentage on the document (sources/fasb-asc.md, 25-7 and 25-8 added). The handbook's projects rule and the line's class parameter say the same, and no handbook sentence lets a shared cost be split across a document's lines. The accounting: the document's entry posts one revenue (an invoice's) or expense (a bill's) line per project its lines name, in the order each is first named, each the sum of that project's lines, and the untagged lines' sum as one more line (arap::document_parts, conservation checked by a proptest). A document naming no project therefore posts exactly the one line every document posted before. The receivable or payable line is never tagged: it is a balance-sheet line, which item 3 counts nothing; the payments (receive_payment, pay_bill) move cash against it and take no project either. Nothing but the projects moves: the P&L, the 1099 worksheet (payments made, B-19) and party totals (what moved the money, B-35) read the same with or without the tags (twin-books test); the projects with the untagged lines still partition the P&L. - ledger-core: DocumentLine.class_id (serde-omitted when none, so old documents serialize as before); create_invoice / create_bill split the revenue or expense side by project and tag it; an unknown project is refused whole (atomically). - ledger-store: a document line's project is journaled as class_id on invoice.created / bill.created, and the entry's line as entry.line_class_set right after its entry.line_added (the entry.posted lines carry class_id, as a hand-built entry's do). Behind a NEW journal feature, document_line_projects (KNOWN_FEATURES, declared by new books, asked for before the first journaled line, not even the control accounts written on refusal); not `projects`, which the live books already declared: the owner consents again at the next upgrade. A malformed class_id is corrupt; null or absent is none. Untagged documents journal byte for byte as before; old journals replay unchanged. - ledger-mcp: each line takes class (id or name, resolved like add_line's, every one before anything is written); the result gains notes for a finished or abandoned project, and on an invoice for an on-spec project (is there now an agreement? on spec a hoped-for payment is no receivable, B-37 item 4), tagged anyway; books lacking the feature refuse with format_upgrade_pending. books.get_entry shows a line's class_id and project. The handbook's "an invoice or bill takes no project yet" caveat now depends on the books: gone where the feature is declared, an "until their format upgrade" note where it isn't. - ledger-gui: an invoice's or bill's page (its entry's) lists the document's lines, each project a link that opens it; the demo's client invoices are tagged to "Client work", whose snapshot is now its revenue less its contractors. Looking at the page in a narrow window found a tagged line's tag pushing the amounts past the pane (any tagged entry): the name is now cut to leave the tag room, the tag itself at most half the cell. - bookspec: an `invoice` event, and `lines` with `project` on a bill or an invoice; example projects-invoice-and-bill-lines-count-by-project, worked by hand, both projects client work (Zeta 3,500.00 - 1,200.00 = 2,300.00; Harbor 200.00; untagged -1,750.00; together the P&L's 750.00; Dana's 1099 payments 1,250.00). - fuzz: fuzz_store_replay can declare journal features. - Tests: core, store, MCP, viewer, the P2-served cutover fixture and a viewer/server parity test (its month lists the same length, not empty); a tagged document's reversal nets its projects to zero, live and replayed; books.get_entry's class_id; the handbook served as a resource both ways; each fix broken to confirm its test fails (docs/testing.md). Docs: rules.md B-27 and B-37 items 3 and 8, sources/fasb-asc.md, plan/served.md D-43, mcp-interface.md, testing.md, parity.md, plan/STATUS.md. No proof changed (no kernel arithmetic: document_parts sums with the existing document_total). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj	2026-10-22 19:28:40 -06:00
swaitsandClaude Opus 5.5	2f999c6050	P3: assets' posted and scheduled depreciation, their bases, and the K-1 on the tax basis (defect 13, D-41) ... Book value is cost less what the books posted; the schedule's figure is apart. An asset's acquired date comes from its entry. Contributed property keeps its section 723 carryover basis apart from its depreciable basis (the lower of value and adjusted basis), with its 704(c) built-in gain and method. The K-1 worksheet reports tax-basis capital (Form 1065 Item L) beside the book figures, leaving open what only the CPA knows. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj	2026-10-21 14:04:12 -06:00
swaitsandClaude Opus 5.5	b0a9fd8ad4	P3: depreciation straight-line by days through the final month, schedules by day (defects 22, 9, D-37) ... The final month takes what the months before leave, spread over its days; a disposed asset stops on its disposal day. A skipped month is caught up in the month the run is made; a reversed run un-posts its month. New schedules spread by day; equal-months schedules must start on the 1st. Amounts round to the currency's own minor unit. Kani and Lean proofs; an exhaustive search over runs, reversals and disposals. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj	2026-10-21 14:04:11 -06:00
swaitsandClaude Opus 5.5	c2ceabbae9	P3: party totals by what moved the money, once (defects 14, 11, 24) ... Each party's part of an entry is signed as its own account would show it, with a direction and its cash and in-kind amounts; a reversal is its original negated. Totals on a cash or all basis: for a member, all equals the members' equity statement and cash the K-1's cash. Money is cash, cards and the financing accounts, and a liability credit never pays its own creditor (creditor_of), so accruals and declared distributions count once. tin_last4 from the TIN or W-9 facts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj	2026-10-21 12:12:26 -06:00
swaitsandClaude Opus 5.5	8693d5a3f5	MCP: short connect text, a handbook, tool annotations, safe local imports ... - The 13K-character instructions (clients cut them short) become a connect text of at most 1,400 characters whose first 512 stand alone, plus books.handbook and books://handbook/{section}: the old guidance by section, with no helper commands, home paths, pull requests or file-reading suggestions (tool_text_lint). - Every tool has a title and read-only/destructive hints; no requiresUserInteraction anywhere (owner decision 2026-10-16). - books.import_local_file reads only regular files inside the import roots (the downloads folder by default, or --import-root), never the data dir, books dir, vault or the key's folder, no symlink escapes or hard links, and the file opened must be the file checked. - The store lock is a tokio mutex taken off the runtime threads. - get_info refreshes settings first; a bare books://digest reads. Review fixes (P0 review, 2026-10-16): - Fail closed: a tokio mutex never poisons and spawn_blocking caught the panic, so after a panic mid-mutation the server kept serving a Store behind its journal. A panic (the task, or while holding the store) now stops the shared store; every later request on every session is refused with a plain message; a restart re-verifies the journal. The join error goes through redact_refusal and never carries the panic's text. - books.set_w9 w9_file_path read any path (a link named w9.pdf to the vault key was stored and get_w9 wrote it out): it now goes through the import roots' lockdown, its type judged on the canonical path. - Sealed even inside a root: the key file in force, where a linked one leads, both folders, and the default key folder whatever the settings say. Refusals check the roots first, so outside them every path gets one message (no probing what exists); inside, other books-dir files say to copy them out first. - The open is O_NOFOLLOW | O_NONBLOCK (a pipe swapped in after the check can't hang a thread) and must match the checked file's device and inode. New dependency: libc (unix only), for those two open flags, which std doesn't name. - Default import roots are the downloads folder only (the plan); files with full TINs (get_w9, vendor_1099 include_tins, the CPA package with TINs) are never written into an import root, and the server refuses to import any file it wrote with TINs (by SHA-256). - set_tin and set_w9 overwrite vault records: destructive_hint = true; annotations_complete pins the key tools' hints. The read-only hint is checked in behaviour on every spec_mcp call (journal and data-dir files unchanged). - Text: the connect text names the settings file as the one local file to edit, says every entry balances on real accounts and names its party, says invoice/bill/payment/payroll tools post unchecked, rewords the exemptions, and shows the company name as one plain line; the handbook takes section "all", lists its ids in the schema and says to read contract first; books.settings drops the config.json path and no error names the data dir or the key file. tool_text_lint covers the whole tool JSON and resources and bans git/commit/FL-0001; tool descriptions over 700 characters are pinned to today's eight (P5). - digest: an empty since= is bare; the default date is pinned on every day of a month. Round-2 review fixes (2026-10-16): - TIN files (B-26): the in-memory, per-session set of TIN-file hashes became one registry beside the vault (vault/tin-files.sha256, hashes only), shared by every session and every later server. It holds the W-9 set_w9 reads (recorded as read), get_w9 copies, 1099 worksheets with TINs, CPA packages with TINs and each file in one that holds a TIN; a file is recorded before it is written, and a failure refuses. import_local_file, attach_receipt and file_document (base64 was never checked) refuse a recorded file, and a text file (by type, name, or UTF-8/UTF-16 decoding) holding a full TIN. Not caught: an altered binary copy; the docs say so (P2/P7 remove the path tools). - The text check is narrow (owner/engineer decision, 2026-10-16: bank exports are filed for reconciliation, and has_full_tin's "nine digits however separated" refused their routing numbers, long references and dates run into amounts). Text is refused when it holds (a) a TIN the vault holds for a party, anywhere, as nine digits, 3-2-4 joined by hyphens, spaces or dots, or 2-7 joined by a hyphen or space, compared on the server against the decrypted vault and never returned or logged (a vault that can't be opened leaves (b)); or (b) a stand-alone printed SSN (123-45-6789) or EIN (12-3456789) shape: no digit, and no hyphen or dot followed by a digit, beside it. Full-width digits and Unicode hyphens and spaces read as ASCII. has_full_tin still guards refusals and results (redact_refusal). Known limit, for P7: a refusal under (a) tells the agent a text it chose holds a vault TIN. New dependency: zeroize in ledger-mcp (already in the workspace through ledger-vault, same major version), so the vault's TINs decoded for the scan are wiped from memory on drop as the vault's own are. - Mutation testing of the final P0 diff (docs/testing.md): tests for each law a survivor broke (handbook titles, a dropped default root, a .jpg W-9, the waker, the walk's folder flags against a link and a pipe, the 40-link limit, save paths refused as such, the package marking only its TIN files, a registry that can't be read, text types, the short receipt rule's counts and a 12-character code). Simpler code where only a race could tell: inspect places an existing path by canonicalize itself (no second comparison), read_checked's read limit is its one size check, openat fails on -1 as specified. The 25 MiB upload test removes its 50 MB of books however it ends. - The GUI's stale-rule prompt no longer says to open a pull request: it asks the agent to find the figure from the rule's official authority, confirm it with the human, pass it explicitly, and tell the human so it can be reported upstream (as the handbook says); a lib test pins it and bans files, git, GitHub and pull requests from every attention prompt. - Import roots (local_files.rs INVARIANT 0): XDG_DOWNLOAD_DIR="$HOME/" made $HOME (or /) the root. No root may be /, the home folder or hold it, or hold the books, data dir, vault or a key: a named one stops the server at startup, a default one is dropped; the default falls back to ~/Downloads only if that is a real folder other than $HOME; with no root, an import says so. - The read is a component walk from / with openat(O_NOFOLLOW | O_DIRECTORY) per folder and O_NOFOLLOW | O_NONBLOCK for the file, so a folder swapped for a link after the check fails; no step may land on a protected inode (one renamed into a root); dev/ino and nlink stay. No /proc. Portable to macOS. (libc's openat, two small unsafe blocks.) - One refusal for missing, dangling and outside paths: resolved() follows every link, dangling ones too, so a link's target existing or not no longer changes the answer. - Sealing: the key files (in force, default) and their targets always; their folders only when not $HOME, not a root, not holding a root; and ~/.config/wanderbooks whatever XDG_CONFIG_HOME says. - Agent text (I-12): RuleNotKnown names the authority (IRS, with its address) and says to tell the human, never a repo path, PR or GitHub; the digest's stale_rules drop the repo catalog and path for it; vault, outside-books, STOPPED and local-file refusals name no git, path or flag. tool_text_lint bans docs/, .md, /home, data dir, --data-dir, --import-root, vault.key, .jsonl, sqlite, .gitignore, github, pull request, and also lints every error template (scanned from source), built error texts, and the server's refusal constants. - The receipt rule told (ReceiptPolicy::rule) is the one enforced: the exact threshold in the base currency (no "$", no rounding), required and exempt accounts, reversals exempt; the connect text fits 1,400 characters by dropping reasons, then codes, never the rule. - The connect text follows the parties setting; "offer books.digest" everywhere. shown_name drops Unicode format characters (bidi, zero width). - read_only_tools_change_nothing compares file contents, the database by every row, the vault and the settings file (raw database bytes did not change either; rows are the stable comparison). - import_local_file takes the name and type from the canonical path; the digest's journal repair says when the tail was set aside, not the journal's file name; "version-history messages" back in the TIN rule; openWorldHint false on every tool, pinned in annotations_complete. - Outside the MCP crate, for the same texts: ledger-core's DatedRule gains `authority` (the statute or publication with its address) and RuleNotKnown carries it; ledger-store's "sqlite error" reads "database error"; ledger-config's ReceiptPolicy::rule takes the base currency. New dev-dependency: rusqlite in ledger-mcp (already in the workspace, same version and features as ledger-store), to read the database's rows in read_only_tools_change_nothing. - The filing scan is no TIN oracle (tin_files.rs INVARIANT 4): text holding more than two TIN-shaped numbers (any rendering rule (a) reads) that end in a known TIN's last four (the books' TIN and W-9 facts, via known_tin_last4, before the vault is opened; then the vault's own) is refused with TIN_PROBE, the same words whether or not one is the vault's TIN; only one or two candidates are compared against the vault. Tests: unit text_probing_for_a_tin_is_refused_alike_whether_or_not_it_holds_it, one_or_two_candidates_are_compared_against_the_vault; over HTTP text_probing_for_a_tin_is_refused_alike_by_every_filing_tool. Plan: plan/served.md P0, section 6 "Immediate hole (P0)", 4.1, 4.3, 4.9. Review round 3. S1: a panic stops the server for every session, so no input may reach one. Dates are four-digit years (new ledger_core:: calendar, 0001-01-01..9999-12-31): the MCP's parse_date is strict YYYY-MM-DD, periods are bounded, last_day_of_month returns a refusal (server and store); schedules, assets, recurring entries, periods, documents, disposals and entries refuse dates outside the calendar, and replay refuses such journal dates. Every amount a command takes is at most a line's (draft lines by size, document lines, payouts, payroll, statements, shares, tax basis, proceeds, recurring templates), on replay too, so sums are exact; the 1099 vendor part and the K-1 property share use checked products (TooLargeToCompute); a recurring run makes at most 1,000 drafts. tests/hostile_args.rs drives every tool with schema-derived hostile arguments and every resource with generated URIs, asserting the server never stops; the audit's panics are pinned. S2: a `.` or `..` path name is refused as NO_SUCH_FILE up front. S3: NUL-interleaved UTF-16 without a byte-order mark is scanned both ways. S4: resource-read refusals are TIN-redacted. S5: set_w9 records its W-9 only once the call passes every check, just before the vault write. S8: idempotentHint only on verify, run_depreciation, run_schedules, run_recurring, set_party_roles (a repeat leaves journal and vault alone; spec_vault checks every candidate twice); every tool's hints pinned in one table. C1: books.settings lists receipt_required_accounts and receipt_exempt_accounts uncut. C2: the default company name reads "a new company". C3: the parties rule names no-party reasons. C4/C5: the handbook names the settings file only as books.settings' books_toml, and restores "check books.digest and offer it". C6: an import root inside the books, data dir or vault is refused at startup. The lint catches `just` however it ends and where the books are; digest_resource_bare_reads reads the server's month. Review round 4 (2026-10-17): round 3's bounds ran in replay too, so journals main wrote and reopened (an entry dated 0000-06-01 or +10000-01-01, a draft line of 2e15, an asset ending past 9999, a basis or share past the line limit, sub-cent document and payroll lines) no longer opened. Posted is forever: the bounds are the commands' only. - Replay applies main's rule exactly: parse_date takes any date chrono reads; replay_add_line(_fx) has no size bound (add_line/add_line_fx do); replay_register_asset/correct_asset (chrono overflow only), replay_set_asset_tax_basis (check_journaled), replay_set_entry_parties (check_shares_journaled), replay_register_recurring (validate_recurring_journaled), replay_register_schedule (months 1 to 600), replay_create_period (order only), replay_dispose_asset, and no line, date, payment or payroll range checks in replay_invoice/bill, their payments and replay_payroll_run. - Derived figures over such books refuse (TooLargeToCompute, DateOutOfRange), never panic: amortization plans, depreciation into chrono's last month (and the true-up for lives past 9999), intervals, document totals and aging, net pay and payroll plans, money flows and share resolution, the asset register, receipt-policy debits; the MCP tools and the viewer show what can't be computed. - tests/fixtures/old-books: the review's 13 journals, its control and 15 more edges, written by main's Store API with main's figures (expected.json); every one opens in the writer and the viewer to those figures, every derived figure computes or refuses, every MCP tool and GUI page answers; hostile_args restarts the server after each property; each bound has a command/replay test pair. Final review: a schedule's plan refuses a total of 10^26 or more (TooLargeToCompute) instead of letting Decimal round its cents silently, and a null `remaining` in the schedule output is always explained by plan_error. Replay is unaffected: no journaled schedule month can belong to a total that large (the line limit bounds every posted month). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj	2026-10-17 09:25:00 -06:00