Interface Ledger

Commits one posting under the caller's txnId: stamps postedAt, assigns the next commit sequence, extends each leg account's hash chain, and folds each leg into the account's running balance — all atomic with the enclosing Store.transaction. Callers take the account locks first (lock/lockMany), so chain heads never fork.

Appends several postings in one engine round trip, exactly as if append ran per posting in order — a later posting chains onto an earlier one's new head when they share an account. Optional: the hot operations that post entry pairs (topUp, settlePayout) fuse through it where the engine offers it; absent, callers loop append.

The archival mover's page read: postings in commit order after cursor, each with its full content, links, posted time, and seq — everything verify-copy-delete needs in one shot (see src/worker/archive.ts). Optional, with prune; both absent means the store cannot host the mover.

A maintained running total: one read, not a sum over the account's whole history.

Streams every account that has a cached running-balance row — such a row can exist with no posting behind it, which heads never visits, so the prover surfaces the mismatch from here.

The balance re-derived from the account's legs, one Amount per currency present (empty when none), folded server-side on SQL so the prover never ships every leg over the wire.

Whether the ledger accepts postings against account: a registered platform account or any well-formed user wallet. The posting guard turns a false into an UNKNOWN_ACCOUNT fault, so a typo can never mint a new account and strand a balance on it.

Streams every account with its chain-head hash, the latest in its tamper-evident chain.

Like heads plus each account's raw signed leg sum in minor units (debit positive — the leg sign convention, not the account's natural side); head and sum must be read in one statement so a concurrent posting can never tear the pair.

How many postings the ledger holds (the newest commit sequence) — the history-size gauge the capacity report reads, O(1) on the SQL engines via the seq index. Optional; a store without it reports the gauge as unknown, never as zero.

Streams every posting that touched account, in commit order, with each recorded hash; the prover replays these because head hashes alone cannot catch an edited line. options.sinceHash bounds the walk to links recorded after the one carrying that head hash — the incremental seal's tail read; an unknown hash streams nothing.

The chain links the posting extended, one per touched account. verifiedPosting (src/chain.ts) recomputes each link's hash from the posting's stored content before any handler derives money from it — the read that makes an in-place edit of stored history fault instead of shaping a reversal. Empty on an unknown id.

One page of every stored chain link in commit order, with each link's posting content — the rolling re-proof's read (src/worker/reproof.ts). limit bounds the postings visited per page (a posting's links never split across pages). cursor is engine-internal ordering state: pass null to start from the oldest posting, then the returned cursor verbatim; a null returned cursor means the walk consumed the newest stored posting.

Streams every committed posting with its full legs, newest first by commit sequence — a total order, so ties never reorder a page.

Takes a row lock on an account so concurrent operations can't race on its balance.

Locks several accounts in one round trip, in a single deadlock-free global order; when absent, callers fall back to per-account lock in that same order. Locks release at commit.

The whole posting committed under txnId, with all its legs, or null on an unknown id.

Deletes the named postings with their legs and chain links — the mover's final step, run inside the same store transaction that updates the signed archive heads, after the page has been re-proved and copied. Never called on unverified or uncopied history.

The account's entries whose postedAt falls in the half-open range, in commit order. Each entry's amount is the leg's signed effect on the account's balance (balanceDelta), not the raw debit-positive leg.

Streams the account's settlement lots; TimelineOptions bounds the read.