Draft safely.
Prove everything.

Give people room to work without handing them the live ledger. Every AI agent, junior bookkeeper, or outside firm works in a safe draft. You review the changes, then approve only what belongs in the official books.

Delegation becomes safe because no one edits the books directly.

Safe drafts are only possible because of what sits underneath them: five layers of proof, each earning the next. Together they are the category — accounting where correctness is mathematics, not trust.

Approved draft + official ledger = still balanced (Thm 6.4)

1. 01

   Immutable algebraic ledger

   Your ledger is a vector; every transaction is a balanced delta. Posting is vector addition, so the books sum to zero by construction — not because software checked, but because the algebra permits nothing else.

   L′ = L + Δ, Δ ∈ B, Σᵢ L[aᵢ] = 0

   Kills: silent edits, unbalanced entries, "plug" accounts.

2. 02

   Canonical hash chain

   Every entry is chained to its evidence — the invoice, the bank line, the contract — by cryptographic hash. Change one byte anywhere in history and the entire chain announces it.

   cₖ = SHA-256(cₖ₋₁ ‖ hₖ ‖ metaₖ)

   Kills: backdated entries, evidence that quietly disappears.

3. 03

   Merkle period roots

   Every period close is compressed into a single Merkle root. Any individual entry can be proven to belong to a closed period in milliseconds, without exposing the rest of the book.

   root = Merkle(c₁ … cₙ)

   Kills: "re-run the report and hope it matches" reconciliation.

4. 04

   Public anchoring

   Signed period heads are lodged outside the system. Once a close is anchored, nobody can rewrite it — not an administrator, not a vendor, not us.

   anchor(sign(rootₚ)) → external notary

   Kills: retroactive restatement without a trace.

5. 05

   Auditor verification bundle

   One bundle contains everything needed to independently rebuild the books from raw evidence: document hashes, commit metadata, posting-rule versions, Merkle proofs, signed heads. The auditor recomputes — and either the math agrees or it does not.

   reconstruct(evidence, rules) ≡ L

   Kills: trust-me audits, sampling in place of certainty.