Merge origin/main

Author: Claude Sonnet (coordinator)

.gitignore

@@ -16,3 +16,6 @@ prd.md
 # Local environment secrets
 .env
 .env.*
+
+# Generated local state sidecars (should not be committed)
+*.ledgerr-state.json

Cargo.lock

@@ -42,14 +42,40 @@ impl Tag {
         Ok(Self(format!("#{normalized}")))
     }
 
+    fn sanitize_body(body: &str) -> String {
+        let mut builder = String::new();
+        let mut last_was_hyphen = false;
+
+        for c in body.trim().chars() {
+            if c.is_ascii_alphanumeric() {
+                builder.push(c.to_ascii_lowercase());
+                last_was_hyphen = false;
+            } else if !builder.is_empty() && !last_was_hyphen {
+                builder.push('-');
+                last_was_hyphen = true;
+            }
+        }
+
+        let sanitized = builder.trim_matches('-').to_string();
+        if sanitized.is_empty() {
+            "tag".to_string()
+        } else {
+            sanitized
+        }
+    }
+
     /// Infallible parse that prefixes '#' if missing and normalizes.
     pub fn normalize(raw: &str) -> Self {
-        let s = if raw.starts_with('#') {
-            raw.to_string()
+        let s = raw.trim();
+        let s = if s.starts_with('#') {
+            s.to_string()
         } else {
-            format!("#{raw}")
+            format!("#{s}")
         };
-        Self::new(&s).unwrap_or_else(|_| Self(s.to_ascii_lowercase()))
+        Self::new(&s).unwrap_or_else(|_| {
+            let body = s.strip_prefix('#').unwrap_or(&s);
+            Self(format!("#{}", Self::sanitize_body(body)))
+        })
     }
 
     pub fn as_str(&self) -> &str {

crates/ledger-core/src/tags.rs

@@ -2,18 +2,13 @@ use serde::{Deserialize, Serialize};
 
 use crate::notify::{NotificationBackend, NotificationTestResult};
 
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
 pub enum SettingsSchemaVersion {
+    #[default]
     V1,
 }
 
-impl Default for SettingsSchemaVersion {
-    fn default() -> Self {
-        Self::V1
-    }
-}
-
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct ShowNotificationsFor {
     pub approval_required: bool,

crates/ledgerr-host/src/settings/schema.rs

@@ -49,6 +49,15 @@ impl SettingsStore {
         temp_file.write_all(&json)?;
         temp_file.flush()?;
         drop(temp_file);
+
+        // On Windows, `std::fs::rename` does not overwrite an existing destination,
+        // so we remove the destination first if it exists to keep the swap atomic
+        // enough for single-user local operation.
+        #[cfg(windows)]
+        if self.path.exists() {
+            std::fs::remove_file(&self.path)?;
+        }
+
         std::fs::rename(temp_path, &self.path)?;
         Ok(())
     }

crates/ledgerr-host/src/settings/store.rs

@@ -359,14 +359,6 @@ fn handle_command(
             sync_state(state, &settings, tray);
             Ok(false)
         }
-        TrayCommand::ToggleStartMinimizedToTray(enabled) => {
-            let mut settings = store.load()?;
-            settings.start_minimized_to_tray = enabled;
-            store.save(&settings)?;
-
-            sync_state(state, &settings, tray);
-            Ok(false)
-        }
         TrayCommand::ToggleWindowVisibleOnStart(enabled) => {
             let mut settings = store.load()?;
             settings.window_visible_on_start = enabled;

crates/ledgerr-host/src/tray/runtime.rs

@@ -16,9 +16,11 @@ fn atomic_save_replaces_old_file_without_partial_contents() {
     let store = SettingsStore::new(path.clone());
     store.save(&AppSettings::default()).unwrap();
 
-    let mut updated = AppSettings::default();
-    updated.toast_enabled = false;
-    updated.start_minimized_to_tray = true;
+    let updated = AppSettings {
+        toast_enabled: false,
+        start_minimized_to_tray: true,
+        ..AppSettings::default()
+    };
     store.save(&updated).unwrap();
 
     let raw = std::fs::read_to_string(path).unwrap();

crates/ledgerr-host/tests/settings_atomicity.rs

@@ -16,7 +16,6 @@ schemars = { version = "0.8", features = ["derive"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 thiserror = "2"
-tokio = { workspace = true, optional = true }
 tracing = { workspace = true }
 
 # plugin_info — always available (cross-platform system metadata)
@@ -40,8 +39,8 @@ ontology = ["core"]
 classification = ["core"]
 audit = ["core"]
 tax = ["core"]
-xero = ["core", "dep:ledgerr-xero", "dep:tokio"]
-llm = ["core", "dep:ledgerr-llm", "dep:tokio"]
+xero = ["core", "dep:ledgerr-xero"]
+llm = ["core", "dep:ledgerr-llm"]
 full = ["core", "events", "reconciliation", "hsm", "ontology", "classification", "audit", "tax", "xero", "llm"]
 self-update = ["dep:reqwest", "dep:semver"]
 

crates/ledgerr-mcp/Cargo.toml

@@ -1,6 +1,6 @@
 /// Regenerates docs/ and scripts/ files from the Rust contract source.
 /// Run: cargo run -p ledgerr-mcp --bin regen-docs
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
 
 use ledgerr_mcp::contract;
 
@@ -13,7 +13,7 @@ fn repo_root() -> PathBuf {
         .to_path_buf()
 }
 
-fn write(root: &PathBuf, rel: &str, content: &str) {
+fn write(root: &Path, rel: &str, content: &str) {
     let path = root.join(rel);
     std::fs::write(&path, content).unwrap_or_else(|e| panic!("write {rel}: {e}"));
     println!("wrote {rel}");

crates/ledgerr-mcp/src/bin/regen-docs.rs

@@ -595,7 +595,7 @@ pub fn generated_capability_contract_markdown() -> String {
 Rust code is the only source of truth for the published MCP surface. If this file drifts from the contract module, tests should fail.\n\n",
     );
     doc.push_str(
-        "The default catalog is intentionally small: 7 top-level `ledgerr_*` tools. Each tool uses a required `action` field so the major capability families stay visible while related operations are grouped under one top-level command.\n\n",
+        "The default catalog is intentionally small: 8 top-level `ledgerr_*` tools. Each tool uses a required `action` field so the major capability families stay visible while related operations are grouped under one top-level command.\n\n",
     );
     doc.push_str("## Published MCP Tools\n\n");
     doc.push_str("| Tool | Purpose | Common actions |\n|---|---|---|\n");
@@ -622,7 +622,7 @@ The server still accepts older `l3dg3rr_*` and proxy-style call names as hidden
     doc.push_str(
         "## Internal Service API\n\n\
 Canonical trait:\n[TurboLedgerTools in crates/ledgerr-mcp/src/lib.rs](../crates/ledgerr-mcp/src/lib.rs#L289)\n\n\
-Important distinction:\n- The MCP surface is the reduced 7-tool catalog defined in Rust.\n- The internal service trait remains more granular and implementation-oriented.\n\n\
+Important distinction:\n- The MCP surface is the 8-tool catalog defined in Rust.\n- The internal service trait remains more granular and implementation-oriented.\n\n\
 API layering:\n1. `ledgerr-mcp-server` (stdio transport)\n2. `contract` (published tool families, action enums, generated schema/doc artifacts)\n3. `mcp_adapter` (dispatch + envelope shaping)\n4. `TurboLedgerService` (domain logic, guardrails, state/event/HSM ops)\n5. `ledger-core` (ingest, filename validation, classification primitives)\n\n",
     );
     doc.push_str("## Example Flow\n\n");
@@ -665,7 +665,7 @@ pub fn generated_agent_runbook_markdown() -> String {
 This file is generated from `crates/ledgerr-mcp/src/contract.rs`.\n\n\
 Agent workflows must use `initialize`, `notifications/initialized`, `tools/list`, and `tools/call` over stdio.\n\n\
 ## Runtime Model\n\n\
-The default published surface is the reduced 7-tool catalog:\n\n{}\n\
+The default published surface is the 8-tool catalog:\n\n{}\n\
 Each tool requires an `action` argument.\n\n\
 ## Bootstrap\n\n\
 From repo root:\n\n```bash\ncargo build -p ledgerr-mcp --bin ledgerr-mcp-server\n```\n\n\