When the snapshot was taken.
How many account heads the root covers.
Identifier of the signing key that sealed this row (Signer.kid), or null on rows from before kid stamping or from a signer without one. Audit metadata, not part of the signed preimage: tampering with it only makes the row's signature fail to verify under the named key, and verification still tries every configured key regardless.
The Merkle root over all account heads (v2: heads and sums), as lowercase hex.
The signature (v1: over root; v2: over root and the 8-byte root sum), as lowercase hex.
The root's balance sum in minor units as a signed decimal string (JSON and the row can't carry a bigint), or null on v1 rows. Zero on every honestly sealed v2 row: the seal refuses to sign a ledger whose raw leg sums do not net to zero.
Preimage construction this row was sealed under. Rows from before versioning decode as 1.
A signed snapshot of the whole ledger: every account's head hash reduced to one Merkle root and signed, meant to be anchored outside this system for independent proof. Version 2 roots carry balance sums up the tree, so the signature (over root hash and root sum together) also attests conservation at seal time; version 1 rows predate the sums and verify forever under the hash-only construction.
See
Integrity for the hash chain and signed-checkpoint construction.