Control accounts move only through their source documents

Your Trade Debtors balance should be the sum of your unpaid invoices — nothing else. The same goes for Trade Creditors and your bills, and for the VAT accounts and the invoices behind them. These are control accounts: their balances are promises that a subledger backs every penny.

Until now, a manual journal could post straight into a control account and quietly break that promise — the balance would drift from the invoices behind it, and reconciliation reports would stop telling the truth. The database itself now rejects such postings (Class M, migration 096), with a message naming the account and the documents that are allowed to move it.

What this means in practice:

Trade Debtors and Trade Creditors move only through invoices and opening balances. The VAT input and output accounts move through invoices, opening balances, and categorised bank entries. The VAT liability account accepts opening balances and VAT-settlement journals. Bad Debts accepts invoice write-offs and manual journals — it is an expense account, and a non-invoice bad debt is a legitimate entry.

The manual journal form no longer offers the protected accounts, and the API returns a clear validation message rather than an error if one is targeted directly. Every flow that legitimately writes to these accounts — invoicing, write-offs, opening balances, bank imports — is unaffected and regression-verified.

Pre-launch, test data only — no customer books were ever affected.