reports: huvudbok and verifikationslista; fiscal_year.reopen

report.general_ledger lists every account with activity or IB, its
postings in date order with a running saldo, and Omslutning/Utgående
saldo; accounts?/from?/to? narrow it. report.voucher_list lists the
year's vouchers with rows and totals, with an optional series filter.

fiscal_year.reopen undoes a close (owner-only, confirm:true, audited) so
the Räkenskapsår screen can toggle the status.

2 files changed, 27 insertions, 12 deletions

diff --git a/docs/PROTOCOL.md b/docs/PROTOCOL.md
index 35390ae..b8ec759 100644
--- a/docs/PROTOCOL.md
+++ b/docs/PROTOCOL.md
@@ -109,7 +109,7 @@ Scopes on a token can narrow but never widen the user's role.
 | Read: vouchers, reports, audit, accounts | ● | ● | ● | ● |
 | `voucher.post`, `voucher.correct`, `attachment.put` | | ● | ● | |
 | `sie.import`, `account.create`, `account.update` | | ● | ● | |
-| `period.lock`, `fiscal_year.open/close`, `org.update` | | | ● | |
+| `period.lock`, `fiscal_year.open/close/reopen`, `org.update` | | | ● | |
 | `org.member_*`, `token.create` for others | | | ● | |
 | `user.create`, any org | | | | ● |
 | `backup.snapshot` | | | ● | ● |
@@ -239,8 +239,9 @@ policy versions with the software. It covers, at minimum:
   (`voucher.correct`)
 - receipts: `attachment.put` before or together with posting
 - locked periods and closed years are hard stops — ask the human
-- `fiscal_year.close`, `period.lock` and `sie.import` are irreversible
-  operations: confirm with the human first
+- `fiscal_year.close` can be undone with `fiscal_year.reopen`; both are
+  owner-only and audited. `period.lock` and `sie.import` are irreversible:
+  confirm with the human first
 - how to read `report.vat` boxes and `report.balance_sheet`
 - on `CONFLICT`/`replayed`, fetch the existing object instead of retrying
 
@@ -285,7 +286,8 @@ Account `type` is one of `asset`, `liability`, `equity`, `revenue`, `expense`.
 |---|---|---|
 | `fiscal_year.list` / `fiscal_year.get` | `org?` / `id` | |
 | `fiscal_year.open` | `label`, `start_date`, `end_date` | owner |
-| `fiscal_year.close` | `id`, `confirm:true` | owner; irreversible |
+| `fiscal_year.close` | `id`, `confirm:true` | owner; audited |
+| `fiscal_year.reopen` | `id`, `confirm:true` | owner; undoes a close |
 | `period.lock` | `fiscal_year`, `until`, `reason?` | owner; `until` inclusive |
 | `period.unlock` | `fiscal_year`, `reason` | owner; audited with reason |
 
@@ -367,7 +369,18 @@ vouchers at posting time (`attachment_ids`) or afterwards via
 | `report.vat` | `from`, `to`, `period_type?` | momsdeklaration ruta för ruta |
 
 All reports are pure reads, respect locks, and return JSON rows. Amounts are
-öre. `report.vat` returns `{"from","to","boxes":[{"box":"05","label":"...","amount_ore":...}],"note"}`.
+öre. `report.general_ledger` (huvudbok) returns account blocks:
+`{"fiscal_year","from","to","last_voucher":{...},"accounts":[{"account",
+"name","ib_ore","debit_ore","credit_ore","ub_ore","rows":[{"series",
+"number","date","description","row_description","debit_ore","credit_ore",
+"saldo_ore"}]}]}`; accounts without IB or period movement are omitted, and
+`accounts` (array of account numbers) filters the list.
+`report.voucher_list` (verifikationslista) returns `{"fiscal_year","from",
+"to","last_voucher":{...},"vouchers":[{"id","series","number","date",
+"description","rows":[{"account","name","debit_ore","credit_ore",
+"description"}]}],"totals":{"debit_ore","credit_ore"}}` and takes an
+optional `series` filter. Both cover the whole fiscal year; the ledger's
+period can be narrowed with `from`/`to`. `report.vat` returns `{"from","to","boxes":[{"box":"05","label":"...","amount_ore":...}],"note"}`.
 Rules sharing a box are summed into a single entry. `box 49` is the sum of
 the moms boxes (`10`,`11`,`12`,`30`,`31`,`32`,`48`,`60`,`61`,`62`), so box 48
 is signed like the blankett (ingående moms negative); underlag boxes do not
diff --git a/docs/STATE.md b/docs/STATE.md
index 0f8a915..b158de8 100644
--- a/docs/STATE.md
+++ b/docs/STATE.md
@@ -100,8 +100,9 @@ server/protocol/ledger only.
 3. K2 årsredovisning document + SRU files (INK2/INK2R/INK2S).
 4. `audit.verify` must also verify the **voucher** hash chain (today only the
    audit chain is verified).
-5. `report.general_ledger` and `report.voucher_list` (documented, not
-   implemented).
+5. ~~`report.general_ledger` and `report.voucher_list`~~ implemented
+   (Huvudbok, Verifikationslista) with Kapitas-style TUI tables; the ledger
+   API supports `accounts`/`from`/`to`, the list an optional `series`.
 6. `describe` argument schemas (currently name/summary/permission only).
 7. Pre-migration `VACUUM INTO` snapshot (promised in SCHEMA.md, not built).
 8. ~~Docker image + compose (multi-arch amd64/arm64, GHCR) and systemd unit.~~
@@ -134,11 +135,12 @@ server/protocol/ledger only.
   (schema v1, old binary) — recreate or migrate it with the current build if
   it is still wanted.
 - TUI smoke tests: drive over a pty with `script -qec`; function-key escape
-  sequences are timing-sensitive there (not an app bug). `Ctrl+N/C/F` are
-  single bytes and reliable. Always wrap the run in
-  `scripts/tui-sandbox.sh -- ./build/bokftui ...`: it isolates
-  `XDG_CONFIG_HOME`/`XDG_CACHE_HOME` so a test can never overwrite the real
-  `~/.config/bokf/tui.conf` or `~/.cache/bokf/tui.log`.
+  sequences are timing-sensitive there (not an app bug). Arrows arrive as
+  application-mode sequences (`ESC O B` for Down), not `ESC [ B`, because
+  curses enables the keypad. `Ctrl+N/C/F` are single bytes and reliable.
+  Always wrap the run in `scripts/tui-sandbox.sh -- ./build/bokftui ...`: it
+  isolates `XDG_CONFIG_HOME`/`XDG_CACHE_HOME` so a test can never overwrite
+  the real `~/.config/bokf/tui.conf` or `~/.cache/bokf/tui.log`.
 
 ## Known caveats