Address review: assert flags round-trip, bump canonical version

Add a store-conformance assertion that an account's flags survive a
create/get round-trip, guarding the SQL flags-column mapping now that
the balance constraint lives there.

Bump CANONICAL_VERSION 4 -> 5: removing the policy field from the Account
preimage changes account snapshot hashes, following the same convention
used when UserData was removed. Record the version bump and the
former-system-account over-debit behavior change in ADR-0018.

crates/kuatia-storage/src/store_tests.rs

@@ -177,6 +177,8 @@ pub async fn create_and_get_account(store: &(impl Store + 'static)) {
     let got = store.get_account(&AccountId::new(1)).await.unwrap();
     assert_eq!(got.id, acc.id);
     assert_eq!(got.version, 1);
+    // The balance constraint lives in `flags`; it must survive the round-trip.
+    assert_eq!(got.flags, acc.flags);
 }
 
 /// Duplicate account creation fails.

crates/kuatia-types/src/canonical.rs

@@ -30,7 +30,9 @@ pub trait ToBytes {
 /// canonical bytes (ADR-0012).
 /// Bumped to 4 when the vestigial `UserData` fields were removed from the
 /// `Envelope` and `Account` preimages.
-pub const CANONICAL_VERSION: u8 = 4;
+/// Bumped to 5 when the `policy` field was removed from the `Account` preimage
+/// (ADR-0018): the single balance constraint now lives in `flags`.
+pub const CANONICAL_VERSION: u8 = 5;
 
 /// Append a `u16` in big-endian to `buf`.
 pub fn write_u16(buf: &mut Vec<u8>, v: u16) {

doc/adr/0018-single-debit-must-not-exceed-credit-flag.md

@@ -95,6 +95,15 @@ overdraft. The `policy` column is dropped from the SQL schema (migration
   of zero.
 * Account intent (customer vs. boundary vs. system) is no longer readable from a
   type; it must be inferred from the flag plus context.
+* A former `SystemAccount`/`ExternalAccount` debited past its available postings
+  now absorbs the shortfall as a negative offset posting instead of failing with
+  `InsufficientFunds`. This is moot for deposits (they net to zero on the
+  boundary account) but is a behavior change for a direct over-debit.
+* Removing `policy` from the `Account` canonical preimage bumps
+  `CANONICAL_VERSION` (4 → 5), changing account snapshot hashes. Persisted
+  transfers keep their original `EnvelopeId`s and stay self-consistent; a saga
+  in flight across the upgrade re-validates on recovery and aborts cleanly (or
+  rolls forward) rather than corrupting state, per ADR-0003.
 
 ## Links