wanderbooks/plan/2026-10-28_DRIFT_REPORT.md

Drift report, 2026-10-28: the plan, the code, and the documents

Written by the planning session on 2026-10-28, after the implementing team (an engineering-manager agent with worker agents in git worktrees, 2026-10-26 to 2026-10-27) was paused. Method: every plan and design document in plan/ and docs/ was read whole and compared with main (44ee4083), the five paused branches (S4.4, S5, S6, S7, P6), their worktrees, dry-run merges (git merge-tree, touching no branch), and the code. Only divergences are listed; what matches is not.

Where we are, in one paragraph

Of the plan's remaining units, nine landed on main in two days (U0a, U0b, U0c, P7, P9a, P13 steps 1-3, P4b S4.1, S4.2, S4.3) and five more are built to their "Done when" lists on unmerged branches (S4.4, S5, S6, S7; P6 is feature-complete with its gate interrupted). Not started: S4.5, P4, P5, P8, P10, P11a, P11b, P12, P13 steps 4-6. The owner's destination, stated 2026-10-28, is one installed app for Mac, Windows and Linux (P11a, then P11b), then the hosted service of section 11; today the executable is Linux-first (the keyring store exists for Linux only, so on macOS an agent cannot connect), nothing of P11a exists, and no macOS or Windows build runs in CI.

plan/served.md

• 8.0.1 and the unit Status lines are stale. The S4 row says "S4.4-S4.5 open"; S4.4 is built on branch S4.4 (002fb9f8, 2 commits, 29 files) with its As-built block written. S5 (ad649be3, 10 commits, 44 files), S6 (6c4480cd, 4 commits, 45 files) and S7 (4b4fecb9, 12 commits, 49 files) say "not started" and are built, each with its As-built block, just check reported green by its worker on the branch rebased on ed637f0e. P6 says "not started" and is built to every step on branch P6, checkpointed as ce366408 ("wip: pause checkpoint, P6 feature complete, gate interrupted (not for merge)"): its just check never finished.
• The merge hazards of the pause are not recorded anywhere. Dry-run merges onto main in plan order: S4.4 clean; then S5 conflicts in crates/ledger-cli/tests/documents.rs (add/add) and crates/ledger-mcp/src/types.rs; S6 in documents.rs (add/add) and docs/mcp-interface.md; S7 in documents.rs (add/add), types.rs, crates/ledger-store/src/lib.rs; P6 in types.rs, store/src/lib.rs, store/src/schema.rs, store/tests/store.rs, docs/parity.md, docs/receipt-store.md, docs/spec/rules.md, docs/testing.md. Each branch alone merges onto main cleanly except P6. Causes: 8.0.3 allocated one over-the-wire test file (crates/ledger-cli/tests/documents.rs) to four units, and each created it; the "append at the end" rule for types.rs collides whenever two units append; P6 branched before S4.3 and took schema 16, which S4.3 holds on main (S5 took 17), so P6 must retake 18 at its rebase. S5 and S6 both numbered their new law 34 in docs/verification.md (S5 Step.markSent, S6 settle_is_exact); S1's documents law, which was never written up, is 34 on main as of this report, so S5 becomes 35, S6 36 and S7's write-off 37 at merge.
• 8.0.3's allocated names drifted, with the EM's approval, and the table was not updated: two new MCP groups, tools/sent.rs (S5) and tools/settlements.rs (S6, which also moved books.receive_payment, books.pay_bill, books.ar_aging, books.ap_aging out of documents.rs); books.mark_sent's recipients parameter is recipients, not to (the no_tool_takes_a_path lint refuses to); P6 built books.set_entry_settles, named in its Build step but absent from the new-tools row (P6 flagged it).
• S6 departed from its Build in ways the owner should see: confirmed (preview then confirm) was not added to books.receive_payment and books.pay_bill (deferred to P4's one sweep); the processor's vendor on a fee is named in the entry's description, not tagged (tags are entry-wide); no schema change (18 not taken); the three bookspec examples were not written (two wait for journaled terms); the over-the-wire discount tests wait for S4.3's journaled terms, which have since landed.
• P6 departed in a way that changes the crate graph: ledger-store now depends on ledger-import (Typst, the fonts, hayro enter the store's dependency closure) so the writer can extract at attach time. docs/architecture.md's dependency rules neither allow nor forbid it; it needs a decision at P6's review (the alternative is extraction in the server before the store call, with the backfill command doing the same).
• S4.4 changes the live contract A-1 planned: existing callers of books.create_invoice and books.create_bill now need confirmed: true; the connect text and handbook on main still say "Invoice, bill, payment and payroll tools post at once, unchecked", so that sentence is stale the moment S4.4 merges (S4.5 owns the handbook; the connect text is handbook.rs).
• Q-5 is due and unasked. Its trigger is "when S4 lands"; S4.1-S4.3 are on main and S4.4 is built. A-14 is still reserved for the answer.
• D-47 to D-54 are the review's recommendations, never explicitly confirmed by the owner ("the owner may revisit"); S5, S6, S7 and P6 were built on them (D-47, D-49, D-52, D-53). Confirming them is now a one-line question (Q-8 below).
• P11a's Build omits the groundwork the design assigns to P11 elsewhere: the macOS and Windows keyring stores (3.3 as built; D-19; crates/ledger-host/src/tokens.rs returns "kept in the keyring on Linux only, until the macOS and Windows apps (P11)" on every other OS, so wanderbooks connect and the bridge fail there), the Windows data root under %LOCALAPPDATA% with an owner-only DACL (3.4), named pipes with a SID check (3.9), and a CI build on macOS and Windows runners (none exists: all three workflows run ubuntu-24.04). None is a step in 8.2 P11a.
• 8.0.2's priority statement is stale against the owner's destination. It names P10 as "the owner's goal" and leaves P11a as "any time"; the owner's statement of 2026-10-28 makes the installed app the destination, with P11a to start now beside the P4b finish (recorded as D-56).
• Section 2 carries superseded sentences without the strike-through rule of section 0: I-1 "Landlock and seccomp confine the server itself where available", I-2 "Landlock harness no_tool_touches_outside_tenant", I-8 "gui_works_under_read_only_landlock" (all → D-32).
• server.toml (3.2, 3.4) was never built; the deployment flags are wanderbooks serve --http and --isolation (P9a). The references read as if it exists.
• 4.9's "The tool count is 118 (2026-10-26)" is 122 on main (U0a's As-built says so) and becomes 130 once the five branches merge (S5 +1, S6 +1, S7 +1, P6 +4, S4.4 +0).
• 8.0.6 item 2 fixtures: S4.3 wrote p4_s43_documents, S5 p4_s5_before, S7 p4_s7_before, P6 p6_evidence; S4.4 and S6 wrote none of their own (S6 reuses p4-arap-before, which predates S1). Acceptable under the item's intent (no figure moves), recorded here so the EM does not look for them.

plan/STATUS.md

• The title and the "Now" section are dated 2026-10-26 and say "P4b S4 next"; since then U0a, U0b, P9a, S4.1-S4.3 landed and S4.4, S5, S6, S7, P6 were built on branches. The pause paragraph (2026-10-27) is the last entry but the head of the file was not revised, so a reader is told the wrong next step.

plan/HANDOFF.md

• "What is true today (2026-10-26)" says nothing after S3 is built. Nine units landed and five are on paused branches.
• No procedure for resuming paused worktrees: the merge order of the five branches, the known conflicts (above), the schema renumbering P6 needs, and that every branch's just check must be re-run after the rebase (the pause killed the gates).
• It does not say that P11a is to be staffed now (D-56).

plan/roadmap.md

• Phase 2 says "27 tools" (122). Phase 3 (oracle harness) reads as not started; just oracle runs 200 random books through GnuCash 5.10 with 15,800 exact comparisons (docs/oracle.md Layer 5); the machine-readable parity catalog and CI floor are the part still open.
• Phase 5 lists A/R and A/P, bank reconciliation and period close as future; all three exist (reconciliation and close since 2026-10-11, A/R and A/P first-class since P4b S1). Multi-currency is partial (foreign lines; no translation), as it says.
• "Explicitly not on the roadmap: payroll" while ledger-core::payroll and the payroll tools exist (accounting only, no tax tables). The sentence means tax tables and filing; it does not say so.
• Nothing names the destination: the installed app (P11a, P11b) and the hosted service (served.md section 11).

plan/gui.md

• "Status (2026-10-12)" predates: the Books menu (back up, restore, new books, connect, close; P2 slice 8), 80 color schemes (D-19's family menu), Invoices & Bills pages and document pages with timelines (P4b S2, S3), Projects pages, old-books compatibility tests, Needs attention computed by ledger-package and only routed by the viewer (U0b), the data root as the only source (wanderbooks gui <book>; --data-dir and --books-toml removed, D-44), the W-9 and TIN clipboard copy (D-29), the format-upgrade dialog (D-39).
• Principle 4 says the GUI "builds its own in-memory view" and offers prompts for the agent; the prompts now come from the shared attention engine.
• The "Next" list (cash forecast, reconciliation view, receipt zoom, keyboard navigation, virtualized lists, web build) was never revisited; the reconciliation page exists; the web build is the hosted service's viewer (section 11).

README.md

• "118 MCP tools" twice (122 on main); "190+ workspace tests" (about 2,700 test functions across the two workspaces).
• The quickstart and the installer claim Linux and macOS. On macOS the executable builds and the viewer runs, but wanderbooks connect and the agent bridge fail: tokens live in the OS keyring and only the Linux Secret Service store is built (tokens.rs, NOT_YET). Windows is WSL2 only, as it says.
• "Status" says the Google Sheet stays the system of record until a clean month and cutover approval; the cutover happened 2026-10-20 (P2 slice 9) and the Sheet is frozen as of 2026-10-11.
• "Mutation testing via cargo-mutants" is paused for development until P12 (D-33; CI still runs its weekly shards).
• The layout omits ledger-vault, bookspec/, verify/, deploy/, fuzz/, oracle/, site/.

AGENTS.md

• "ledger-core depends only on rust_decimal, thiserror, chrono, serde, serde_json": it also depends on jiff (the time-zone database for company.timezone's "today", P1). The rule needs the sixth name or a justification recorded.
• The docs index omits docs/testing.md, docs/parties-and-attachments.md, plan/served.md (the plan every remaining unit is built from), plan/HANDOFF.md, bookspec/, deploy/.

docs/architecture.md

• "Current crate layout" shows ledger-core alone with six files; the workspace has ten crates (plus the bookspec workspace of two), and ledger-core has about 25 modules. "Future crates (do not create until the roadmap says so)" lists ledger-store, ledger-import, ledger-export, ledger-oracle as future: the first two exist, ledger-export was folded into ledger-import, and the GnuCash cross-check is tests/oracle_gnucash.rs with oracle/gnucash/, not a crate. ledger-config, ledger-mcp, ledger-cli, ledger-host, ledger-vault, ledger-gui, ledger-package are described in later sections or not at all; there is no dependency graph.
• "the projection has a table for each (schema v12)": 16 (17 on branch S5).
• The ledger-mcp groups list will need sent and settlements when S5 and S6 merge (their branches add them).
• The P6 branch's ledger-store → ledger-import dependency is not covered by the dependency rules (see served.md above).

docs/parity.md

• "Floor: 10 done (2026-10-10)" while the table holds 21 done rows.
• No P4b entry at all. S1 (documents read their figures from standing lines, the control guard, books.void_document, books.control_check), S2 (books.documents, books.document, the viewer pages), S3 (the invoice PDF) and S4.1-S4.3 (terms, numbers, line accounts, the issued PDF filed) landed without touching the catalog, against AGENTS.md's "every feature change updates docs/parity.md in the same commit". The A/R and A/P rows' notes still read "R-FUTURE-5".
• "Automated cross-implementation diff harness (GnuCash first) | todo" while just oracle runs it weekly (docs/oracle.md Layer 5); what remains is the fixture-book snapshot diff and the machine-readable catalog.
• "Workflow/UI parity ... gets its own catalog when the egui phase starts": the viewer exists; no such catalog was started (not a defect: the owner made MCP the primary interface, 2026-10-10).

docs/capability-parity.md

• The cutover rule reads as pending. The cutover happened 2026-10-20 (P2 slice 9); the Sheet is frozen as of 2026-10-11 and the final verify-sheet run is a filed workpaper (served.md 8.4). The document should say so and keep the rule for the record.

docs/parallel-run.md

• Entirely pre-cutover ("70 workspace tests"; "delete the wanderbooks data dir" as rollback). Historical since 2026-10-20; it carries no banner saying so.

docs/requirements.md

• R-13 names require_receipts_above with a default of "25.00" enforced by the MCP layer; the policy is the journaled setting policy.evidence.* (P1, B-29), evaluated by ledger-config's ReceiptPolicy today and moving into ledger_core::evidence in P4 (I-5 as amended by D-47).
• "CPA handoff package: ... P&L and balance-sheet PDFs (printpdf, MIT)": Typst since 2026-10-11, and the package holds the cash flow, GL, journal IIF, receipts, documents, the 1099 worksheet and the K-1 worksheets.
• "A/R and A/P workflows ... MCP tools for the full workflow" says nothing of D-45 (figures derived from tagged standing lines; hand lines on the control accounts refused) or of what documents_v2 adds behind the owner's upgrade.

docs/oracle.md

• Layer 3 (mutation testing) is "live now"; development mutation runs are paused until P12 (D-33), CI's weekly shards aside.
• Layer 5 both says the GnuCash differential is live and that "a ledger-oracle crate will run fixture books ... cargo xtask oracle"; there is no crate and none is planned (the harness is tests/oracle_gnucash.rs).
• "What the oracle does NOT cover: workflows ... a UI concern for the egui phase, where storytold's screenshot-in-the-loop comes back": the viewer exists with screenshot tests (crates/ledger-gui/tests/*.rs, shot(..)).

docs/receipt-store.md

• "Migration from Google Drive" is written as future work; the company records were filed at the P1 cutover (D-20) and the Drive manifest and comparison tools were struck (served.md 8.4). The schema notes (v16, a file per schema) are current.

docs/parties-and-attachments.md

• "Status: design; built after asset tax basis": built (parties, roles, the TIN vault, attachments to any subject, 2026-10-15 to 2026-10-17); D-55's contact block is built on branch S4.4.

docs/mcp-interface.md

• The per-tool sections are held to the code by every_tool_is_documented_and_every_documented_tool_exists; no drift there. The framing is stale: "Crates in this phase" lists two crates and calls ledger-store "SQLite persistence" (the journal is the source of truth); "Muse" among the clients; "Out of scope for this phase". P5 owns the overview rewrite (its step 6).

docs/testing.md

• The Layers table says just prove runs 48 harnesses and prove-slow 8; the code has 60 (#[kani::proof]), 51 in prove and 9 in the justfile's kani_slow.
• The mutation rows say "weekly" with no mention of D-33 (development runs paused until P12; CI's scheduled.yml still runs the shards).
• Units U0a and S4.1-S4.3 have no section; U0a added no tests (none owed) and S4's For-P12 paragraph is S4.5's by the plan, so this is deferred, not missing.

docs/verification.md

• The harness table lacks P4b S1's two Kani harnesses, bounds_check_matches_definition and bounds_kept_is_the_definition_on_books_in_bounds (kernel::running_bounds, bounds_kept), and there is no section for S1's law (Lean control_agrees, control_agrees_through, Reachable.control_is_documents in Documents.lean), against AGENTS.md's "every harness and theorem listed". S7's branch amends the "out of scope" list; S5's branch adds rule 34 (Step.markSent).
• "Running it": 48 and 8 harnesses (51 and 9).

docs/spec/README.md, docs/spec/rules.md

• No drift detected beyond the open sources already listed in 8.4 (B-38 to B-45 stay CONVENTION until vendored). The branches add B-41 (S7), B-42 (S6), B-44 (P6) and their bookspec ids.

site/index.html, install.sh

• Both claim Linux and macOS. On macOS the install succeeds and the viewer runs, but wanderbooks connect claude (the installer's last step) fails on the keyring (see README above), so the one-line promise does not hold there until P11a's keyring stores. "Native Windows is on the way" is right. The site is deployed by hand (just deploy); the built copy under site/dist lags any source edit until then.

deploy/README.md, deploy/wanderbooks-server.service

• No drift detected against P9a as built. Done-when 1 (the GitHub Actions job's first run) and 2 (the recipe walked on a clean VM by a non-author in under 30 minutes) are still the owner's to verify.

bookspec/README.md

• No drift detected. Branch S7 extends the example schema (write_off, a refused lines entry); the README on that branch says so.

plan/review-2026-10-26/

• Historical. No drift detected.

Housekeeping found on the way (not plan drift)

• Build caches: about 1 TB under the six target/ directories (wanderbooks 196 GB; wb-S6 220 GB, wb-S5 194 GB, wb-P6 167 GB, wb-S4.4 117 GB, wb-S7 109 GB) with 1.7 TB free. Once the branches merge, cargo clean in each worktree and git worktree remove recover it.
• 27 jj workspaces are registered (p3-*, p4-*) whose directories under ~/.cache/wanderbooks/ no longer exist: jj workspace forget each.
• Branch rescue/p4-invproj-20261026 ("wip: rescue uncommitted p4-invproj work before cache cleanup, never merged", 51 files) sits beside main, which holds that work's landed form (528c0706, including its bookspec example projects-invoice-and-bill-lines-count-by-project); nothing on it is missing from main. Delete it after a last look.

The deviations, judged

Every departure recorded in an As-built block was read against the unit's text and AGENTS.md:

• Reasonable, keep: S4.1's interim guard (removed by S4.3 as promised); S4.2 declaring documents_v2 early (the settings writes needed the gate); S4.3 skipping the parties columns (no parties table exists; replay and differs_from carry the facts) and the _with carriers; S4.4 requiring the new bill fields only under documents_v2 (8.0.4's "everything else works at once"); S5's Lean step for mark_sent (I-13 wins over the unit's "no Lean change") and the recipients rename (the lint is older than the unit); S6's tools/settlements.rs (the EM approved it to keep documents.rs single-owner) and the fee's processor in the description; S7's least_owed_from bound (B-38 invariant 2 at every later day, stricter than the unit) and the one-receipt-once rule; U0a's 122 (the unit's 118 was stale); U0b's extra PackageBooks reads and the integrity fix (a real parity gap found); P9a's loopback-only door (the review caught a plaintext static-bearer door bound to every address); P7 keeping the filing scan narrow (B-26's design); P13's Engine::change and the CHOICE vocabulary.
• Reasonable but owed back: S4.3's missing journal transaction (an I/O failure between the invoice's lines and its attachment's is not rolled back: a property of every multi-line command, to be fixed once for all in P12 or a small unit of its own); S6 deferring confirmed to P4 (right, since P4's sweep touches every confirm tool, but P4 must now add it rather than only preview); S6's unwritten bookspec examples (owed to P13 step 4 or S6's follow-up now that terms are journaled); the two S1 harnesses missing from docs/verification.md.
• Needs a decision: P6's ledger-store → ledger-import dependency (architecture), and P6's whole branch is a checkpoint whose gate never ran: it is not yet a reviewed unit.
• Not reasonable, fix: none found. No golden moved on main; no kernel arithmetic outside kernel.rs was introduced by the landed units; no unit touched the owner's books.

Where to go next (the order)

1. Resume and land the paused branches, in this order, each rebased on main and just check (and just prove where it says) re-run after the rebase: S4.4 → S5 (resolve documents.rs by concatenation, types.rs by keeping both appends; schema 17 stands) → S6 (documents.rs, docs/mcp-interface.md) → S7 (documents.rs, types.rs, store/lib.rs; just prove for writeOff_within_bounds) → P6 (eight files; retake schema 18; run its gate to the end; review the store → import dependency). Then S4.5, the only unstarted P4b slice.
2. Ask the owner Q-5 and Q-8 (served.md 10.3) when S4.4 lands; the documents_v2 upgrade of the live books follows the answer (after S7 and P4 under D-52).
3. Start P11a now (D-56), beginning with its new step 0 (the macOS and Windows keyring stores, the Windows data root and pipes, a CI matrix on macOS and Windows runners), then the cargo-packager trial. P11a is independent of the P4b and P4 chain and is the owner's destination.
4. Then the chain as planned: P4 (now also adding confirmed to the settlement tools) → P5 → P8 → P10; P13 steps 4-6 beside; P11b after P11a; P12 last.
5. Update the documents in this report's list (done in the same change as this report where the fix is a fact, not a decision).