Core concepts

The ledger

Append-only, and why that is not negotiable.

Every movement of money writes a ledger_entry. Entries are never updated and never deleted, a database trigger refuses both, so the guarantee survives a migration, a psql session, and a future role misconfiguration.

Read one end user's trail

seams users ledger ada

# TYPE          AMOUNT USD  BALANCE AFTER  AT
# grant               5.00            5.00  2026-09-01T10:02:11Z
# usage_debit        -0.03            4.97  2026-09-01T10:04:02Z
# usage_debit        -0.01            4.96  2026-09-01T10:04:18Z

Entry types

TypeMeans
topupThe end user paid and their balance was credited
grantCredit issued without a payment, a trial, a support gesture
usage_debitInference consumed, at raw provider cost
refundMoney returned
reversalA top-up undone, a chargeback, or a duplicate
adjustmentA correction, including credit from an orphaned hold

Idempotency is a unique index, never application logic. A check-then-insert has a race window; a constraint does not.