Operating controls, not theatre.
Posted entries stay posted
Corrections are written beside the original entry. The old number remains visible.
Reopens need a second name
A reopen keeps its reason, signer, second signer, scope, and relock timing.
Bank files are reviewed
CSV rows are parsed into an import history and reviewed before they become ledger activity.
Pull the close package
Export the reports and statements needed for review. This is not a raw database dump.