Ledger execution
Read the exact action guide for prerequisites, identifier discovery, supported input, effects, captured successful and refused responses, verification and recovery. Synthetic fixture results do not authorize a live mutation or establish a provider outcome.
- Get opening balances: The conversion date and the opening-balance journal the books start from: each account with its opening debit or credit, the amount that went to the opening-balances account to make it balance, and the totals.
- Set opening balances: Set the conversion date and the balances the books open with. Amounts are signed base-currency minor units per account (positive debit, negative credit). Any previous opening journal is reversed, one new journal is posted the day before the conversion date, and whatever does not balance goes to the opening-balances equity account. Refused with period_locked when that day is locked.
- Get trial balance: Every account holding a balance at the date, each on one side only: debitMinor carries a debit balance, creditMinor a credit balance, and the other is zero. Accounts that net to nothing are left out. totalDebitMinor and totalCreditMinor are the sums of those balances and must agree, which is what balanced reports. These are balances, not turnover: they do not add up everything ever posted to an account, which would count both sides of every entry and count an expense again when a year-end close reverses it.
- Get account ledger lines: General ledger detail for one account: lines in posting order, paged with limit and offset. openingBalanceMinor is the balance immediately before the returned page, including both activity before the requested range and earlier lines in that range.
- Rebuild balance projection: Recompute the account balance projection from the ledger lines and report whether it already matched.
- Verify ledger integrity: Prove the ledger has not been altered. depth full (the default) walks the whole chain, re-hashes every event, checks every posting balances and the cursor matches the chain tip, and names the sequence where any break happened; it reads the entire ledger, so it grows with the books. depth tip re-hashes only the newest event and checks the cursor still points at it, which is constant work and is what a screen refreshing on every load should ask for. Only full detects a change made to older history.
Evidence
Actual Books route handlers and the exported Worker were exercised against five local SQLite D1 concern databases with all committed migrations, the real posting Durable Object and local R2. Route captures use synthetic verified Auth; Worker captures use synthetic Auth transports. Nexus, Brand, Notify, Pay, Mercury and Xero responses are explicitly simulated at the provider transport boundary. Captures prove local request/response behavior and canonical SDK projection, not live bank access, payment movement, email delivery, provider eligibility, tax compliance, encrypted custody, scheduled execution, deployment or production completion. Fixture identities, credentials, addresses and records authorize no live operation.