ledger: let a client create the book everything else keys off

[Yaraslaut]

Closes #361.

ledger was the only rung shipping a server whose root aggregate could not be created over the wire. OpenAccount refused with OpenAccount: no such ledger, every other action was keyed on a ledgerId that had to already exist, and src/server/main.cpp seeded nothing — so a freshly started ladder_ledger_server served a book nobody could open. The rung's own tests seeded the row through the DataMapper, which is not available to anything on the other side of a socket.

Reproduced first, against a live server on a fresh LEDGER_DB:

ok   step 4 [books] session principal=$who token=$token
FAIL step 5: do OpenAccount ledgerId=1 name="Cash" kind=0 currency=1
  reply: err message="OpenAccount: no such ledger"

The shape

CreateLedger { name } → CreateLedgerResult { id } on LedgerModel, registered keyless — it is the one action on that model carrying no ledgerId, so there is nothing for BRIDGE_KEY_FROM to key on.

The precedent followed is polls::PollModel/CreatePoll: a model keyed by its aggregate id whose creating action is keyless. Deliberately not kanban's ProjectAdminModel, which is a separate model because it has per-project RBAC to administer; ledger has none, so splitting a model out would buy nothing.

The name bound in validate() is tied to LedgerRecord::name's SqlAnsiString<128> by a static_assert, the same guard and for the same reason as kanban's kMaxProjectNameBytes. Success and refusal both journal through the existing logAction/logFailure pair.

Authorization: any authenticated principal may create a book, and no owner is recorded — because there is no per-book role table to record one in. That is a real gap rather than a design, and it is filed as #382 rather than half-built here.

The harness

The new scenarios/ledger/bootstrap-a-book-over-the-wire.scenario names no seeded id at all — it creates its book, opens accounts in it, and works from there, which is the journey this issue said no client could perform.

The two seeded ledgers rows in run_scenarios.py stay, as a fixture convenience for the 14 sibling files pinned to ids 1 and 2. What changes is seed()'s doc comment, which asserted as fact that ledgers rows "are created by no registered action" — true when written, false as of this PR, and exactly the kind of stale prose the drift guard exists for.

Coverage pins move deliberately: the action universe 71 → 72, the ledger workflow floor 15 → 16.

Verification

Command	Result
ladder_ledger_tests	All tests passed (685 assertions in 135 test cases) — 7 new CreateLedger cases, 26 assertions
run_scenarios.py --rung ledger --twice	exit 0, 16 files green on both passes against one database
mutate_scenario.py on the new file	31 mutants, 31 caught, 0 survived
test_morph_scenario.py	Ran 118 tests … OK
scenario_coverage.py	exit 0 — ledger 18/18 dispatched, workflows 16/16, total actions dispatched: 72/72
check_spec_citations.sh	exit 0

Specs updated rather than left to contradict the code: the ledger rung-5 design §1, the corpus-expansion inventory (15 → 16 journeys), scripts/scenario/README.md, examples/ledger/README.md, and a CHANGELOG.md entry under ### Added.

Not verified: ladder_ledger_tests cannot be built with MORPH_ENABLE_STRICT_COMPILATION=ON from a worktree nested under the main checkout (#372, pre-existing and unrelated), so the test run above comes from a non-strict build dir. The model and DTO themselves compile clean under -Weverything -Werror in ladder_ledger_lib. The other four rungs' scenarios, the framework's own C++ suite and a Doxygen build were not run.

Filed rather than folded in: #382 (any authenticated principal can read and write any book — reproduced over the wire: bob reads and writes a book alice created) and #383 (mutate_scenario.py never flips != back to ==, so all 13 != assertions in the corpus go operator-unmutated — reproduced while mutating the new scenario).

🤖 Generated with Claude Code

https://claude.ai/code/session_01GnSnsebJ92Kti1D7m3RwYJ

[codecov]

Codecov Report

❌ Patch coverage is 94.44444% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
examples/ledger/src/models/ledger_model.cpp	94.11%	0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!