Protect ledger balance, immutability and workspace isolation

Purpose

Ledger safeguards prevent unbalanced, mutable or cross-workspace accounting records.

How It Works

Posting writes entries through the ledger’s constrained persistence path. The database checks balanced totals and account ownership. Stored records reject ordinary updates and application deletion. Controlled unposting removes an ordinary posting’s entries through the guarded function. Fiscal reopening instead retains its system entries and adds their mirrors. Workspace deletion uses the purge participant, which refuses to act on a live workspace.

Relationships

Related outcome: Produce document entries using the applicable accounting method, which addresses the connected batch work.
Related outcome: Unpost a batch for correction and replacement posting, which addresses the connected batch work.
Related outcome: Inspect and report on posted ledger entries, which addresses the connected batch work.

Show evidence (sources, provenance, origins, pinned commits)

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes: Ledger protections refuse invalid writes and restrict deletion to the guarded recovery and purge paths.
Surfaces: job
Constraints: Platform coordinates workspace deletion and this module contributes ledger purge.
Intent sources: services-accounting:docs/architecture/accounting-2.0/02-decisions.md#A-1services-accounting:docs/architecture/accounting-2.0/02-decisions.md#D-04services-accounting:docs/accounting/batches.md#Unposting deletes the entries (Andrew, Reporting D7, 2026-10-21)services-accounting:docs/migrations/batch-posting/README.md#Merge readiness (Andrew's D9 of 2026-10-15: tenant deletion removes the posted ledger)

Controls

18 controls apply, from the corpus control catalogue.

TC-IAM-001 TC-IAM-005 TC-IAM-006 TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-AZ-005 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-TEN-004 TC-DAT-004 TC-LOG-001 TC-LOG-002 TC-LOG-003 TC-LOG-005 TC-PI-005

Business Rules

8 rules, 8 to be proved before approval. A rule's product intent is derived from its origin: 1 confirmed by a product decision, the rest inheriting this capability's proposed.

Id	Rule	Kind	Enforced at	Provenance
`01`must prove Proposed	Every stored entry needs at least two lines and equal debits and credits in base currency and each transaction currency, with the database checking balance at commit. origin: services-accounting:docs/architecture/accounting-2.0/02-decisions.md#A-1 proved by `ATS-ACC-BAT-015-13`, `ATS-ACC-BAT-017-01`, `ATS-ACC-BAT-017-07`, `TST-ACC-BAT-093`	invariant	database, service	test services-accounting:modules/batches/tests/integration/services/persistence/subledger-entries.integration.spec.js#refuses an entry whose debits and credits differ, at commit, by the balance constraint
`02`must prove Confirmed	Amounts are nonnegative whole minor units with their direction expressed as debit or credit. origin: services-accounting:docs/architecture/accounting-2.0/02-decisions.md#D-04 proved by `ATS-ACC-BAT-017-02`, `TST-ACC-BAT-087`	invariant	database	test services-accounting:modules/batches/tests/integration/services/persistence/ledger-minor-units.integration.spec.js#converts each line with its unit's base exponent and its transaction currency's, and each schedule entry with its schedule's
`03`must prove Proposed	Stored headers and lines reject updates even from their owner, and the application cannot delete them directly. origin: services-accounting:docs/architecture/accounting-2.0/02-decisions.md#A-1 proved by `ATS-ACC-BAT-017-03`, `ATS-ACC-BAT-017-09`, `ATS-ACC-BAT-018-08`, `TST-ACC-BAT-029`, `TST-ACC-BAT-093`, `TST-ACC-BAT-112`	invariant	database	test services-accounting:modules/batches/tests/integration/services/persistence/subledger-entries.integration.spec.js#cannot be updated even by the table owner: the append-only trigger refuses it, naming the table
`04`must prove Proposed	Removal is restricted to guarded deletion of a current ordinary posting within its workspace or workspace purge. origin: services-accounting:docs/accounting/batches.md#Unposting deletes the entries (Andrew, Reporting D7, 2026-10-21) proved by `ATS-ACC-BAT-016-12`, `ATS-ACC-BAT-017-03`, `ATS-ACC-BAT-017-08`, `TST-ACC-BAT-029`, `TST-ACC-BAT-093`, `TST-ACC-BAT-112`	invariant	database	test services-accounting:modules/batches/tests/integration/services/posting/unpost-deletes-entries.integration.spec.js#is the only way to delete a ledger row: the application role is refused a direct delete
`05`must prove Proposed	Each line account must belong to its entry’s business unit. proved by `ATS-ACC-BAT-017-04`, `TST-ACC-BAT-093`	invariant	database	test services-accounting:modules/batches/tests/integration/services/persistence/subledger-entries.integration.spec.js#refuses a line whose G/L account belongs to another business unit, by the same-unit foreign key
`06`must prove Proposed	A posting cannot contain duplicate entries for one document or schedule entry, and an original entry permits only one reversal referencing that workspace’s entry. proved by `ATS-ACC-BAT-017-04`, `ATS-ACC-BAT-017-10`, `TST-ACC-BAT-093`	invariant	database	test services-accounting:modules/batches/tests/integration/services/persistence/subledger-entries.integration.spec.js#refuses a second entry of the same transaction in the same posting, by the no-duplicates key
`07`must prove Proposed	During workspace deletion, the ledger participant purges ledger, postings, schedules and jobs before batches and configuration and refuses purge while the workspace remains live. origin: services-accounting:docs/migrations/batch-posting/README.md#Merge readiness (Andrew's D9 of 2026-10-15: tenant deletion removes the posted ledger) proved by `ATS-ACC-BAT-017-05`, `TST-ACC-BAT-079`	lifecycle	database, service	test services-accounting:modules/batches/tests/integration/services/lifecycle/ledger-purge.integration.spec.js#removes every batch posting table’s rows, the ledger’s first among them, and answers done with nothing left
`08`must prove Proposed	Workspace isolation prevents reading another workspace’s ledger. proved by `ATS-ACC-BAT-017-06`, `TST-ACC-BAT-028`, `TST-ACC-BAT-105`	invariant	database	test services-accounting:modules/batches/tests/integration/services/posting/rebuilt-documents.integration.spec.js#answers another tenant none of the entries, by batch or by transaction (the row-level policy)

Scenarios

Id	Given	When	Then	Provenance
`01`	A ledger entry is stored under a posting.	An application or the table owner changes its amount.	The update is refused and the stored accounting remains intact.	test services-accounting:modules/batches/tests/integration/services/persistence/subledger-entries.integration.spec.js#cannot be updated even by the table owner: the append-only trigger refuses it, naming the table
`02`	Platform is deleting a workspace containing posting history.	The ledger participant purges and configuration purge follows.	No rows for that workspace remain in the examined accounting tables.	test services-accounting:modules/batches/tests/integration/services/lifecycle/ledger-purge.integration.spec.js#lets configuration be purged once the posting tables are gone, leaving no row of the tenant in any tenant table

Planning

Implementation

Protect ledger balance, immutability and workspace isolation ​

Purpose ​

How It Works ​

Relationships ​