diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
new file mode 100644
index 0000000..0f5b5f3
--- /dev/null
+++ b/.github/workflows/check.yml
@@ -0,0 +1,15 @@
+# Every change: format, clippy and rustdoc with zero warnings, every test.
+# Tools come from mise.toml, the same as on a laptop.
+name: check
+on:
+  push:
+  pull_request:
+jobs:
+  check:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: jdx/mise-action@v2
+      - name: GUI build dependencies
+        run: sudo apt-get update && sudo apt-get install -y libxkbcommon-dev libgtk-3-dev
+      - run: just check
diff --git a/.github/workflows/scheduled.yml b/.github/workflows/scheduled.yml
new file mode 100644
index 0000000..e916bdf
--- /dev/null
+++ b/.github/workflows/scheduled.yml
@@ -0,0 +1,40 @@
+# Weekly, and on demand: the slow layers (docs/testing.md).
+name: scheduled
+on:
+  schedule:
+    - cron: "17 6 * * 1"
+  workflow_dispatch:
+jobs:
+  prove:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: jdx/mise-action@v2
+      - run: just prove
+  oracle:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: jdx/mise-action@v2
+      - run: just oracle
+  fuzz:
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [fuzz_journal_line, fuzz_entry_validate, fuzz_op_sequence, fuzz_core_serde, fuzz_store_open]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: jdx/mise-action@v2
+      - run: just fuzz ${{ matrix.target }} 600
+  mutants:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: jdx/mise-action@v2
+      - run: just mutants
+      - if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: mutants
+          path: mutants.out
diff --git a/Cargo.lock b/Cargo.lock
index 1873dff..66d4905 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -172,6 +172,15 @@ dependencies = [
  "alloc-no-stdlib",
 ]
 
+[[package]]
+name = "alloca"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5a7d05ea6aea7e9e64d25b9156ba2fee3fdd659e34e41063cd2fc7cd020d7f4"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "allocator-api2"
 version = "0.2.21"
@@ -212,6 +221,18 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "anes"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b46cbb362ab8752921c97e041f5e366ee6297bd428a31275b9fcf1e380f7299"
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
 [[package]]
 name = "anyhow"
 version = "1.0.104"
@@ -827,6 +848,12 @@ dependencies = [
  "wayland-client",
 ]
 
+[[package]]
+name = "cast"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
+
 [[package]]
 name = "cc"
 version = "1.7.0"
@@ -951,6 +978,31 @@ dependencies = [
  "serde_path_to_error",
 ]
 
+[[package]]
+name = "clap"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa8876b300ab35ba921adea3dfd70157a46249b33f95c9084ae5709785478946"
+dependencies = [
+ "clap_builder",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0797fb7aeb1406c84efac526901f7ec3ead2124f946b494e72879d4b54704d"
+dependencies = [
+ "anstyle",
+ "clap_lex",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c133bc6a41be0d194c306b5506d15e6feeea7b1d6604bd3f8310dfb2ca96486"
+
 [[package]]
 name = "clipboard-win"
 version = "5.4.1"
@@ -1166,6 +1218,41 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "criterion"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "950046b2aa2492f9a536f5f4f9a3de7b9e2476e575e05bd6c333371add4d98f3"
+dependencies = [
+ "alloca",
+ "anes",
+ "cast",
+ "ciborium",
+ "clap",
+ "criterion-plot",
+ "itertools 0.13.0",
+ "num-traits",
+ "oorandom",
+ "page_size",
+ "plotters",
+ "rayon",
+ "regex",
+ "serde",
+ "serde_json",
+ "tinytemplate",
+ "walkdir",
+]
+
+[[package]]
+name = "criterion-plot"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8d80a2f4f5b554395e47b5d8305bc3d27813bacb73493eb1001e8f76dae29ea"
+dependencies = [
+ "cast",
+ "itertools 0.13.0",
+]
+
 [[package]]
 name = "crossbeam-deque"
 version = "0.8.8"
@@ -1534,7 +1621,7 @@ dependencies = [
  "bitflags 2.13.2",
  "emath",
  "epaint",
- "itertools",
+ "itertools 0.15.0",
  "log",
  "nohash-hasher",
  "profiling",
@@ -1606,7 +1693,7 @@ dependencies = [
  "egui",
  "enum-map",
  "image",
- "itertools",
+ "itertools 0.15.0",
  "jiff",
  "log",
  "mime_guess2",
@@ -3095,6 +3182,15 @@ dependencies = [
  "once_cell",
 ]
 
+[[package]]
+name = "itertools"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "413ee7dfc52ee1a4949ceeb7dbc8a33f2d6c088194d9f922fb8318faf1f01186"
+dependencies = [
+ "either",
+]
+
 [[package]]
 name = "itertools"
 version = "0.15.0"
@@ -3390,6 +3486,7 @@ name = "ledger-core"
 version = "0.1.0"
 dependencies = [
  "chrono",
+ "criterion",
  "proptest",
  "rust_decimal",
  "serde",
@@ -4204,6 +4301,12 @@ version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
+[[package]]
+name = "oorandom"
+version = "11.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6790f58c7ff633d8771f42965289203411a5e5c68388703c06e14f24770b41e"
+
 [[package]]
 name = "open"
 version = "5.4.4"
@@ -4249,6 +4352,16 @@ dependencies = [
  "pin-project-lite",
 ]
 
+[[package]]
+name = "page_size"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30d5b2194ed13191c1999ae0704b7839fb18384fa22e49b57eeaa97d79ce40da"
+dependencies = [
+ "libc",
+ "winapi",
+]
+
 [[package]]
 name = "palette"
 version = "0.7.7"
@@ -4529,6 +4642,34 @@ dependencies = [
  "time",
 ]
 
+[[package]]
+name = "plotters"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5aeb6f403d7a4911efb1e33402027fc44f29b5bf6def3effcc22d7bb75f2b747"
+dependencies = [
+ "num-traits",
+ "plotters-backend",
+ "plotters-svg",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "plotters-backend"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df42e13c12958a16b3f7f4386b9ab1f3e7933914ecea48da7139435263a4172a"
+
+[[package]]
+name = "plotters-svg"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51bae2ac328883f7acdfea3d66a7c35751187f870bc81f94563733a154d7a670"
+dependencies = [
+ "plotters-backend",
+]
+
 [[package]]
 name = "png"
 version = "0.18.1"
@@ -5970,6 +6111,16 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "tinytemplate"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be4d6b5f19ff7664e8c98d03e2139cb510db9b0a60b55f8e8709b689d939b6bc"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "tinyvec"
 version = "1.13.3"
@@ -7372,6 +7523,22 @@ dependencies = [
  "web-sys",
 ]
 
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
 [[package]]
 name = "winapi-util"
 version = "0.1.11"
@@ -7381,6 +7548,12 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
 [[package]]
 name = "windows"
 version = "0.62.2"
diff --git a/crates/ledger-core/Cargo.toml b/crates/ledger-core/Cargo.toml
index b251ee8..2b70ea3 100644
--- a/crates/ledger-core/Cargo.toml
+++ b/crates/ledger-core/Cargo.toml
@@ -17,4 +17,9 @@ serde_json = "1"
 workspace = true
 
 [dev-dependencies]
+criterion = "0.8.2"
 proptest = "1"
+
+[[bench]]
+name = "books"
+harness = false
diff --git a/crates/ledger-core/benches/books.rs b/crates/ledger-core/benches/books.rs
new file mode 100644
index 0000000..44e92a2
--- /dev/null
+++ b/crates/ledger-core/benches/books.rs
@@ -0,0 +1,94 @@
+//! Benchmarks for the hot paths (rank 6: a budget, never correctness).
+//!
+//! `cargo bench -p ledger-core --bench books`. Books of 1k and 10k entries
+//! over a 40-account chart: posting, cloning (the store clones the ledger
+//! to rehearse every command), trial balance, balance sheet, and a
+//! period's P&L. Baselines are recorded in docs/testing.md; there is no
+//! budget yet, so nothing gates on them.
+
+use chrono::NaiveDate;
+use criterion::{BenchmarkId, Criterion, criterion_group, criterion_main};
+use ledger_core::reports::{balance_sheet_as_of, profit_and_loss_for_period, trial_balance};
+use ledger_core::{AccountType, Currency, Ledger, Money, Side};
+use rust_decimal::Decimal;
+use std::hint::black_box;
+
+const TYPES: [AccountType; 5] = [
+    AccountType::Asset,
+    AccountType::Liability,
+    AccountType::Equity,
+    AccountType::Revenue,
+    AccountType::Expense,
+];
+
+/// `entries` balanced two-line entries across 2026 over 40 accounts.
+fn books(entries: u64) -> Ledger {
+    let mut l = Ledger::new(Currency::USD);
+    let ids: Vec<u64> = (0..40)
+        .map(|i| {
+            l.add_account(
+                &format!("{}", 1000 + i),
+                "a",
+                TYPES[i as usize % 5],
+                None,
+                false,
+            )
+            .unwrap()
+        })
+        .collect();
+    let mut x: u64 = 0x9e37_79b9;
+    for n in 0..entries {
+        x = x.wrapping_mul(6_364_136_223_846_793_005).wrapping_add(1);
+        let date =
+            NaiveDate::from_ymd_opt(2026, 1, 1).unwrap() + chrono::Days::new(n * 365 / entries);
+        let e = l.create_entry(date, "bench");
+        let m = Money::new(Decimal::new((x % 1_000_000) as i64 + 1, 2), Currency::USD);
+        l.add_line(e, ids[(x >> 8) as usize % 40], Side::Debit, m)
+            .unwrap();
+        l.add_line(e, ids[(x >> 20) as usize % 40], Side::Credit, m)
+            .unwrap();
+        l.post_entry(e).unwrap();
+    }
+    l
+}
+
+fn bench(c: &mut Criterion) {
+    let end = NaiveDate::from_ymd_opt(2026, 12, 31).unwrap();
+    for n in [1_000u64, 10_000] {
+        let l = books(n);
+        let mut g = c.benchmark_group(format!("{n} entries"));
+        g.sample_size(20);
+        g.bench_function(BenchmarkId::new("clone (store rehearsal)", n), |b| {
+            b.iter(|| black_box(l.clone()))
+        });
+        g.bench_function(BenchmarkId::new("post one more entry", n), |b| {
+            b.iter_batched(
+                || l.clone(),
+                |mut l| {
+                    let e = l.create_entry(end, "one more");
+                    let m = Money::new(Decimal::new(100, 2), Currency::USD);
+                    l.add_line(e, 1, Side::Debit, m).unwrap();
+                    l.add_line(e, 2, Side::Credit, m).unwrap();
+                    l.post_entry(e).unwrap();
+                    l
+                },
+                criterion::BatchSize::LargeInput,
+            )
+        });
+        g.bench_function(BenchmarkId::new("trial balance", n), |b| {
+            b.iter(|| black_box(trial_balance(&l)))
+        });
+        g.bench_function(BenchmarkId::new("balance sheet", n), |b| {
+            b.iter(|| black_box(balance_sheet_as_of(&l, end).unwrap()))
+        });
+        g.bench_function(BenchmarkId::new("one month's P&L", n), |b| {
+            let start = NaiveDate::from_ymd_opt(2026, 6, 1).unwrap();
+            let stop = NaiveDate::from_ymd_opt(2026, 6, 30).unwrap();
+            b.iter(|| black_box(profit_and_loss_for_period(&l, start, stop, None).unwrap()))
+        });
+        g.finish();
+    }
+}
+
+criterion_group!(benches, bench);
+criterion_main!(benches);
diff --git a/crates/ledger-import/Cargo.toml b/crates/ledger-import/Cargo.toml
index c16f5b2..b41f043 100644
--- a/crates/ledger-import/Cargo.toml
+++ b/crates/ledger-import/Cargo.toml
@@ -17,3 +17,6 @@ typst-pdf = "0.15.1"
 typst = "0.15.1"
 serde_json = "1"
 typst-layout = "0.15.1"
+
+[lints]
+workspace = true
diff --git a/crates/ledger-store/src/journal.rs b/crates/ledger-store/src/journal.rs
index 10afae8..cdd4ac0 100644
--- a/crates/ledger-store/src/journal.rs
+++ b/crates/ledger-store/src/journal.rs
@@ -72,6 +72,38 @@ fn sort_value(v: &Value) -> Value {
     }
 }
 
+impl JournalLine {
+    /// Parse one journal line, refusing what the journal never holds.
+    ///
+    /// ```text
+    /// GOAL: read a journal line so that its canonical form (which the
+    ///       hash chain covers) is a fixed point.
+    /// SOURCE: R-2 (no floats in money paths); found by fuzz_journal_line
+    ///         (2026-10-13): a float payload re-canonicalized differently.
+    /// INVARIANTS:
+    ///   1. NEVER accepts a floating-point number anywhere in the line:
+    ///      amounts are decimal strings and ids are integers.
+    ///   2. For an accepted line, parse(canonical) re-canonicalizes to the
+    ///      same bytes.
+    /// ```
+    pub fn parse(raw: &[u8]) -> Result<JournalLine, String> {
+        let value: Value = serde_json::from_slice(raw).map_err(|e| e.to_string())?;
+        if has_float(&value) {
+            return Err("a number with a fraction or exponent; the journal holds none".into());
+        }
+        serde_json::from_value(value).map_err(|e| e.to_string())
+    }
+}
+
+fn has_float(v: &Value) -> bool {
+    match v {
+        Value::Number(n) => n.is_f64(),
+        Value::Array(a) => a.iter().any(has_float),
+        Value::Object(m) => m.values().any(has_float),
+        _ => false,
+    }
+}
+
 /// Hex SHA-256 of bytes.
 pub fn sha256_hex(bytes: &[u8]) -> String {
     let mut h = Sha256::new();
@@ -158,7 +190,7 @@ pub fn read_and_verify_journal(path: &Path) -> Result<Vec<JournalLine>, StoreErr
     let mut expected_prev = GENESIS_PREV.to_string();
     for (i, raw) in reader.lines().enumerate() {
         let raw = raw?;
-        let line: JournalLine = serde_json::from_str(&raw).map_err(|e| {
+        let line: JournalLine = JournalLine::parse(raw.as_bytes()).map_err(|e| {
             StoreError::JournalCorrupt(format!("seq {}: unparseable line: {e}", i + 1))
         })?;
         let want_seq = i as u64 + 1;
@@ -204,7 +236,7 @@ pub fn truncate_to_last_good_seq(path: &Path) -> Result<u64, StoreError> {
         if line_str.trim().is_empty() {
             break; // blank line: our writer never emits these
         }
-        match serde_json::from_str::<JournalLine>(line_str) {
+        match JournalLine::parse(line_str.as_bytes()) {
             Ok(line) if line.seq == last_good_seq + 1 && line.prev == expected_prev => {
                 expected_prev = sha256_hex(line.to_canonical().as_bytes());
                 last_good_seq = line.seq;
diff --git a/crates/ledger-store/src/snapshot.rs b/crates/ledger-store/src/snapshot.rs
index 424bcd9..4efe631 100644
--- a/crates/ledger-store/src/snapshot.rs
+++ b/crates/ledger-store/src/snapshot.rs
@@ -118,7 +118,7 @@ impl Snapshot {
         let complete = &buf[..=last_newline];
         let mut added = 0;
         for raw in complete.split(|&b| b == b'\n').filter(|l| !l.is_empty()) {
-            let line: JournalLine = serde_json::from_slice(raw).map_err(|e| {
+            let line: JournalLine = JournalLine::parse(raw).map_err(|e| {
                 StoreError::JournalCorrupt(format!(
                     "seq {}: unparseable line: {e}",
                     self.lines.len() + 1
diff --git a/crates/ledger-store/tests/store.rs b/crates/ledger-store/tests/store.rs
index b0d0cbd..953a940 100644
--- a/crates/ledger-store/tests/store.rs
+++ b/crates/ledger-store/tests/store.rs
@@ -1065,3 +1065,26 @@ fn books_written_under_older_rules_still_open() {
         "108.34567".parse::<Decimal>().unwrap()
     );
 }
+
+/// Regression (fuzz_journal_line, 2026-10-13, crash-c9fa20f3): a journal
+/// line holding a number too large for an integer parsed as a float, and
+/// its canonical form (which the hash chain covers) re-canonicalized
+/// differently. The journal never holds floats (R-2), so the reader now
+/// refuses them; float-free lines are a fixed point.
+#[test]
+fn a_journal_line_with_a_float_is_refused() {
+    use ledger_store::JournalLine;
+    let crash = br#"{"payload":4444454444444444404444,"prev":"x","seq":8,"ts":";u","type":""}"#;
+    assert!(JournalLine::parse(crash).is_err());
+    assert!(
+        JournalLine::parse(br#"{"payload":{"amount":1.5},"prev":"x","seq":1,"ts":"t","type":"a"}"#)
+            .is_err()
+    );
+    let ok = br#"{"payload":{"amount":"1.50","id":7},"prev":"x","seq":1,"ts":"t","type":"a"}"#;
+    let line = JournalLine::parse(ok).unwrap();
+    let canon = line.to_canonical();
+    assert_eq!(
+        JournalLine::parse(canon.as_bytes()).unwrap().to_canonical(),
+        canon
+    );
+}
diff --git a/docs/oracle.md b/docs/oracle.md
index fbd87d1..f951e9e 100644
--- a/docs/oracle.md
+++ b/docs/oracle.md
@@ -65,11 +65,19 @@ case is unreachable), and untestable-by-construction mutants are noted
 unbalanced ledger to falsify it).
 
 **Layer 4 — Fuzzing (live now).** `cargo fuzz` targets in `fuzz/`
-(nightly, libfuzzer): `fuzz_journal_line` (journal parsing never panics;
-canonical form is a fixed point), `fuzz_entry_validate` (a validated entry
-always balances exactly), `fuzz_op_sequence` (arbitrary op sequences via
-`arbitrary`; the trial balance always balances). 11.5M execs, zero crashes
-as of 2026-10-10. Corpora persist in `fuzz/corpus/` for regression.
+(nightly, pinned in `mise.toml`; `just fuzz <target> <seconds>`):
+`fuzz_journal_line` (journal parsing never panics; the canonical form is
+a fixed point), `fuzz_entry_validate` (a validated entry always balances
+exactly), `fuzz_op_sequence` (arbitrary command sequences with periods,
+closes, foreign lines, and raw-bit amounts; the books stay valid),
+`fuzz_core_serde` (every persisted core type round-trips), and
+`fuzz_store_open` (a corrupt journal is an error, never a panic). Hangs
+count (`-timeout=10`). Minimal seeds are checked in under `fuzz/seeds/`;
+the grown corpora in `fuzz/corpus/` are not (tens of MB). On 2026-10-13,
+54M executions found one crash: a float in a journal line broke the
+canonical form's fixed point, and the reader now refuses floats
+(`a_journal_line_with_a_float_is_refused`). Every crash is minimized and
+promoted to a named regression test.
 
 **Layer 4½ — Formal proofs (live now).** The accounting arithmetic lives
 in one generic kernel (`kernel.rs`). Kani model-checks it exhaustively
diff --git a/docs/testing.md b/docs/testing.md
new file mode 100644
index 0000000..acffc3f
--- /dev/null
+++ b/docs/testing.md
@@ -0,0 +1,94 @@
+# Testing strategy
+
+How wanderbooks knows its books are right. Strongest oracle first: a
+test's worth is where its idea of "correct" comes from, not what it runs.
+Formal proofs are in `docs/verification.md`; the authorities every rule
+comes from are in `docs/spec/`. Scope so far: `ledger-core` in full, and
+the store's journal safety; the other crates come next (gap list).
+
+## Layers
+
+| Layer | Oracle (rank) | Where | Command | Runtime | Gates |
+|---|---|---|---|---|---|
+| Spec-derived examples | written specs with sources (1) | `tests/spec_*.rs`, `invariants.rs`, `statements.rs`, `assets.rs`, ... | `just check` | seconds | every change |
+| Regressions | the bug, named (1) | beside the code they cover, `*_regression`/named for the defect | `just check` | seconds | every change |
+| Compatibility contracts | journals written under older rules must open (1) | `ledger-store/tests/store.rs` (`books_written_under_older_rules_still_open`) | `just check` | <1s | every change |
+| Properties | laws over all inputs (2) | `properties.rs`, `spec_*.rs`, `kernel_bridge.rs` | `just check` | seconds | every change |
+| Metamorphic | scaling, reversal, ordering invariance (2) | `spec_reports.rs` | `just check` | seconds | every change |
+| Refusal law (store) | a refused command never reaches the journal (2) | `store.rs` `refused_commands_never_reach_the_journal` | `just check` | ~15s | every change |
+| Model-based stateful | the Lean state machine, transcribed (3) | `tests/model.rs` | `just check` | ~3s | every change |
+| Differential: Decimal vs i64 | the kernel at two types (3) | `kernel_bridge.rs` | `just check` | <1s | every change |
+| Differential: GnuCash | another implementation, adjudicated (3) | `tests/oracle_gnucash.rs`, `oracle/gnucash/` | `just oracle` | ~2 min | weekly |
+| Formal proofs | Kani (bounded) and Lean (unbounded) | `src/proofs.rs`, `verify/lean/` | `just prove` | ~3 min | weekly |
+| Fuzzing | crash, hang, broken books (4) | `fuzz/fuzz_targets/`, corpora in `fuzz/corpus/` | `just fuzz <target> <secs>` | 10 min each | weekly |
+| Miri | undefined behavior in our use of dependencies (4) | the core's unit, bridge, invariant tests | `just miri` | ~2 min | on demand |
+| Golden | `tests/golden/fixture_company.json` (5) | `invariants.rs` | `just check` | <1s | every change |
+| Benchmarks | a budget (6) | `benches/books.rs` | `just bench` | ~1 min | none (no budget yet) |
+| Mutation | can the tests fail? | `ledger-core` | `just mutants` | ~12 min | weekly |
+
+CI: `.github/workflows/check.yml` runs `just check` on every push;
+`scheduled.yml` runs proofs, the oracle, fuzzing, and mutation weekly.
+
+Seeds and failure databases: proptest's `*.proptest-regressions` files
+are checked in and replay on every run. The GnuCash oracle's books come
+from fixed seeds (`SEED` in `oracle_gnucash.rs`). Fuzz corpora live in
+`fuzz/corpus/<target>`.
+
+Golden review: `fixture_company.json` is hand-verified (docs/oracle.md,
+Layer 1). The van depreciation golden was replaced on 2026-10-13 by a
+hand computation (`van_schedule_is_the_hand_computed_one`) after every
+row was checked against it.
+
+## Benchmarks (baseline 2026-10-13, no budget yet)
+
+40-account chart, two-line entries across a year, on the development
+laptop:
+
+| | 1k entries | 10k entries |
+|---|---|---|
+| clone the ledger (store rehearsal, per command) | 56 µs | 1.0 ms |
+| post one more entry | 1.0 µs | 5.8 µs |
+| trial balance | 44 µs | 1.07 ms |
+| balance sheet | 47 µs | 1.04 ms |
+| one month's P&L | 25 µs | 248 µs |
+
+## Assumed, not confirmed (reject any)
+
+Each was inferred, not decided by a human; the tests that rely on them
+say so in their doc comments.
+
+- ASSUMED: a P&L for a period whose start is after its end is refused.
+- ASSUMED: a balance sheet omits accounts with a zero balance.
+- ASSUMED: the lifetime `profit_and_loss` counts closing entries
+  (only period statements exclude them).
+- ASSUMED: closing a period with nothing to close still marks it closed.
+- ASSUMED: a sweep account (draws, distributions) is zeroed as of the
+  period end, like income.
+- ASSUMED: reconciliation balances are debits minus credits (tested on
+  cash; liability accounts unspecified).
+- ASSUMED: a members' equity statement allocates prior unclosed earnings
+  and the period's income separately; one statement's ending for a member
+  may differ by a cent from the next statement's beginning (only totals
+  are guaranteed to chain).
+- ASSUMED: cash flow lists one working-capital or financing line per
+  account that changed; with no registered assets, investing is zero.
+- ASSUMED: an asset's life ends on purchase date + life months, that day
+  not held.
+- ASSUMED: a payroll entry has one line per account total, not per
+  employee.
+- ASSUMED: a period with exactly the dates of an existing one nests in it
+  (is allowed).
+
+## Gap list: what isn't covered, and what would bring it in
+
+| Technique | Status | Trigger |
+|---|---|---|
+| Fault injection | SKIP for the core (no I/O, clock, or network) | the first I/O or clock in `ledger-core`; the store is next in scope (torn writes, full disk) |
+| Integration | SKIP for the core (no collaborators) | the core gains one; covered at the store and MCP layers |
+| End-to-end | SKIP for the core (a library) | MCP stdio tests cover the journeys |
+| Security properties | SKIP for the core (no roles, no secrets) | the first permission concept, or a secret-bearing field |
+| Concurrency stress | SKIP for the core (no shared state) | the first `Arc`, atomic, or lock in the core; the GUI and MCP server have threads (next) |
+| Lean: apportion's sum law for any n | OPEN | Kani covers n <= 3, properties n <= 5; needs a permutation lemma |
+| ASC paragraphs not yet read | OPEN | ASC 360-10-35-4, 340-10, 230-10-45-10, 606-10-55-37B, 210: needs a FASB basic-view login |
+| GnuCash's own close | OPEN | the oracle books closes as ordinary entries; comparing GnuCash's Close Book needs its Scheme API |
+| Store, import, MCP, config, GUI crates | NEXT | in that order, the same playbook |
diff --git a/fuzz/.gitignore b/fuzz/.gitignore
new file mode 100644
index 0000000..aac29ef
--- /dev/null
+++ b/fuzz/.gitignore
@@ -0,0 +1,4 @@
+/target/
+/corpus/
+/artifacts/
+/coverage/
diff --git a/fuzz/Cargo.lock b/fuzz/Cargo.lock
new file mode 100644
index 0000000..8fad456
--- /dev/null
+++ b/fuzz/Cargo.lock
@@ -0,0 +1,942 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "ahash"
+version = "0.8.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae221649c9976a6f6c56ae1facf410f3ddb33cc661c4b7b61020a912d4237fbc"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "arbitrary"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3bc62ac97cc33321f50863d514c3bc38a453947a8f9e781137e47c7401020aed"
+dependencies = [
+ "derive_arbitrary",
+]
+
+[[package]]
+name = "arrayvec"
+version = "0.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3fb67a6e08acf24fdeccbac2cb6ac4305825bd1f117462e0e6f2f193345ad56"
+
+[[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "bitflags"
+version = "2.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "borsh"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "553c5d846a6ba5150c65e3b1b8ec073bcf1abc20f9b7220de384a4443ea4e20a"
+dependencies = [
+ "borsh-derive",
+ "bytes",
+ "cfg_aliases",
+]
+
+[[package]]
+name = "borsh-derive"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12cdfe656708a01f89b451a7d36466e6fe6c414de0aa18fc54f864f6f9ca9f56"
+dependencies = [
+ "once_cell",
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "bytes"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+
+[[package]]
+name = "cc"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6651c9ed80effdc7db0ff72512157f901af5e3549e341e24b1dd4887d836d838"
+dependencies = [
+ "find-msvc-tools",
+ "jobserver",
+ "libc",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
+
+[[package]]
+name = "chrono"
+version = "0.4.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
+dependencies = [
+ "iana-time-zone",
+ "js-sys",
+ "num-traits",
+ "serde",
+ "wasm-bindgen",
+ "windows-link",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "derive_arbitrary"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b034bd7d5f032402a2479444dcc6f74e36a03f31854d41680fb240ef682a1ac"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "fallible-iterator"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2acce4a10f12dc2fb14a218589d4f1f62ef011b2d0cc4b3cb1bba8e94da14649"
+
+[[package]]
+name = "fallible-streaming-iterator"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
+
+[[package]]
+name = "futures-core"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
+
+[[package]]
+name = "futures-task"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
+
+[[package]]
+name = "futures-util"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+dependencies = [
+ "ahash",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
+[[package]]
+name = "hashlink"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ba4ff7128dee98c7dc9794b6a411377e1404dba1c97deb8d1a55297bd25d8af"
+dependencies = [
+ "hashbrown 0.14.5",
+]
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.14.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.17.1",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "jobserver"
+version = "0.1.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
+dependencies = [
+ "getrandom 0.4.3",
+ "libc",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7883d941dae510fb2d978fc3fe018c71c9e2892fd38854de3e8b92c2e5ad9cc5"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "ledger-core"
+version = "0.1.0"
+dependencies = [
+ "chrono",
+ "rust_decimal",
+ "serde",
+ "serde_json",
+ "thiserror",
+]
+
+[[package]]
+name = "ledger-core-fuzz"
+version = "0.0.0"
+dependencies = [
+ "arbitrary",
+ "chrono",
+ "ledger-core",
+ "ledger-store",
+ "libfuzzer-sys",
+ "rust_decimal",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "ledger-store"
+version = "0.1.0"
+dependencies = [
+ "chrono",
+ "hex",
+ "ledger-core",
+ "rusqlite",
+ "rust_decimal",
+ "serde",
+ "serde_json",
+ "sha2",
+ "thiserror",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.190"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
+
+[[package]]
+name = "libfuzzer-sys"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9fd2f41a1cba099f79a0b6b6c35656cf7c03351a7bae8ff0f28f25270f929d2"
+dependencies = [
+ "arbitrary",
+ "cc",
+]
+
+[[package]]
+name = "libsqlite3-sys"
+version = "0.30.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e99fb7a497b1e3339bc746195567ed8d3e24945ecd636e3619d20b9de9e9149"
+dependencies = [
+ "cc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "log"
+version = "0.4.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "proc-macro-crate"
+version = "3.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
+dependencies = [
+ "toml_edit",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand"
+version = "0.8.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e058c7de0b26af77780c769414d6257830bb240f3c38477dbc2c16e5f54d6d4c"
+dependencies = [
+ "libc",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.17",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
+[[package]]
+name = "rusqlite"
+version = "0.32.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7753b721174eb8ff87a9a0e799e2d7bc3749323e773db92e0984debb00019d6e"
+dependencies = [
+ "bitflags",
+ "fallible-iterator",
+ "fallible-streaming-iterator",
+ "hashlink",
+ "libsqlite3-sys",
+ "smallvec",
+]
+
+[[package]]
+name = "rust_decimal"
+version = "1.43.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7653272e75dcac41dc199fbea6f5797633994fafd339943c06c9af16bf29cd3a"
+dependencies = [
+ "arrayvec",
+ "borsh",
+ "bytes",
+ "num-traits",
+ "rand 0.8.8",
+ "rand 0.9.5",
+ "serde",
+ "serde_json",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.154"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.16.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b3dc8af474f516a851ff4bd12db780f948b9250ad37211e4eec0bccea54e01b"
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d78c8dee4c7bf0e14673097256fed6142ce9d3b85a408189d07482442145823b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09e52cb86a36cede5cb101bf8908837b3e4c6e5e59fe7fd85c23fb56200d189e"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b86d767906c6c42421dcba507eb9d203e779497710a47782a224bb871653053"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.25.17+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3641d5bbb5349a79e1020a242d251efbc546ad8048d133958323ce9c40a9c9c"
+dependencies = [
+ "indexmap",
+ "toml_datetime",
+ "toml_parser",
+ "winnow",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.1.5+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baa693a8032d7e1cada7d0041e96126df243179ff061456783ac7f12bda4744c"
+dependencies = [
+ "winnow",
+]
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2c754d6c33795a1c324727428e5a7dedb5b06195f9890bdbcba760d3e246563"
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasip2"
+version = "1.0.4+wasi-0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.129"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9bb54f33acc68fd454578d9820b0bde1a1a3d17aa17bb7b6595806d02886d409"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "serde",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.129"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e29d0c35b16e224a7eeb5cd2d25e3e1968fbd65604117b44d3b789d00ee8535"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.129"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f501a8bc3719dba86ef8ae4728879c08001bea749eb1333ac5b91e040e2a6b7"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.129"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23f0c9c52aa7cd7d77769a4cfe2a9adb1b331f489a41d912ce14513d5ab995c6"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "winnow"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
+[[package]]
+name = "zerocopy"
+version = "0.8.63"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5fe1f8f1b06191a00962174c61aa5005e0bb391a6d80d07e24d115c01a92ed8"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.63"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "863ad3ac83293fb4d740aedbfdc9240dd8d1a50c1099acd76ce80ce7c7230c7f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
diff --git a/fuzz/Cargo.toml b/fuzz/Cargo.toml
index 92f8038..bc99eef 100644
--- a/fuzz/Cargo.toml
+++ b/fuzz/Cargo.toml
@@ -11,6 +11,7 @@ cargo-fuzz = true
 libfuzzer-sys = "0.4"
 arbitrary = { version = "1", features = ["derive"] }
 serde_json = "1"
+serde = "1"
 rust_decimal = "1"
 chrono = "0.4"
 
@@ -42,3 +43,17 @@ doc = false
 bench = false
 
 [workspace]
+
+[[bin]]
+name = "fuzz_core_serde"
+path = "fuzz_targets/fuzz_core_serde.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "fuzz_store_open"
+path = "fuzz_targets/fuzz_store_open.rs"
+test = false
+doc = false
+bench = false
diff --git a/fuzz/fuzz_targets/fuzz_core_serde.rs b/fuzz/fuzz_targets/fuzz_core_serde.rs
new file mode 100644
index 0000000..9348820
--- /dev/null
+++ b/fuzz/fuzz_targets/fuzz_core_serde.rs
@@ -0,0 +1,27 @@
+// Fuzz target: every type the store persists from ledger-core, fed
+// arbitrary bytes. Garbage must be refused, never panic; whatever parses
+// must round-trip: serialize, parse again, serialize, same bytes.
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+use serde::{Serialize, de::DeserializeOwned};
+
+fn round_trip<T: Serialize + DeserializeOwned>(data: &[u8]) {
+    if let Ok(v) = serde_json::from_slice::<T>(data) {
+        let once = serde_json::to_string(&v).expect("a parsed value serializes");
+        let again: T = serde_json::from_str(&once).expect("its own output parses");
+        assert_eq!(serde_json::to_string(&again).unwrap(), once, "not a fixed point");
+    }
+}
+
+fuzz_target!(|data: &[u8]| {
+    round_trip::<ledger_core::JournalEntry>(data);
+    round_trip::<ledger_core::Asset>(data);
+    round_trip::<ledger_core::Period>(data);
+    round_trip::<ledger_core::Invoice>(data);
+    round_trip::<ledger_core::Bill>(data);
+    round_trip::<ledger_core::AmortizationSchedule>(data);
+    round_trip::<ledger_core::RecurringEntry>(data);
+    round_trip::<ledger_core::PayrollRun>(data);
+    round_trip::<ledger_core::Money>(data);
+});
diff --git a/fuzz/fuzz_targets/fuzz_journal_line.rs b/fuzz/fuzz_targets/fuzz_journal_line.rs
index 5c0b10f..994f408 100644
--- a/fuzz/fuzz_targets/fuzz_journal_line.rs
+++ b/fuzz/fuzz_targets/fuzz_journal_line.rs
@@ -1,6 +1,6 @@
 // Fuzz target: journal line parsing must never panic, and the canonical
 // form must be a fixed point: parse(canonical(x)) re-serializes to the
-// same canonical bytes. Staged here; `cargo fuzz init` wires it up.
+// same canonical bytes.
 #![no_main]
 
 use libfuzzer_sys::fuzz_target;
@@ -8,10 +8,11 @@ use ledger_store::JournalLine;
 
 fuzz_target!(|data: &[u8]| {
     // Garbage must return Err, never panic.
-    if let Ok(line) = serde_json::from_slice::<JournalLine>(data) {
+    // Parse as the journal reader does (it refuses floats: the journal
+    // never holds one, and a float's canonical form isn't a fixed point).
+    if let Ok(line) = JournalLine::parse(data) {
         let canon = line.to_canonical();
-        let line2: JournalLine =
-            serde_json::from_str(&canon).expect("canonical form must re-parse");
+        let line2 = JournalLine::parse(canon.as_bytes()).expect("canonical form must re-parse");
         assert_eq!(
             line2.to_canonical(),
             canon,
diff --git a/fuzz/fuzz_targets/fuzz_op_sequence.rs b/fuzz/fuzz_targets/fuzz_op_sequence.rs
index 7bd7567..470aab2 100644
--- a/fuzz/fuzz_targets/fuzz_op_sequence.rs
+++ b/fuzz/fuzz_targets/fuzz_op_sequence.rs
@@ -1,28 +1,49 @@
-// Fuzz target: arbitrary operation sequences against a Ledger. Errors
-// are fine (invalid ops are rejected); the invariant is that the trial
-// balance ALWAYS balances afterward, no matter the sequence. This is the
-// stateful counterpart of the proptest properties — libfuzzer explores
-// deeper interleavings. Staged here; `cargo fuzz init` wires it up.
+// Fuzz target: arbitrary command sequences against a Ledger, including
+// balanced pairs, foreign-currency lines, periods, and closes, with
+// amounts built from raw decimal bits (huge, tiny, odd scales). Refusals
+// are fine; panics, hangs, and broken books are not. After any sequence:
+// the trial balance balances, every posted entry validates, and no draft
+// sits in a closed period (the Lean invariant Inv).
 #![no_main]
 
 use arbitrary::Arbitrary;
 use chrono::NaiveDate;
-use ledger_core::{AccountType, Currency, Ledger, Money, Side};
+use ledger_core::{AccountType, Currency, EntryStatus, Ledger, Money, Side};
 use libfuzzer_sys::fuzz_target;
 use rust_decimal::Decimal;
 
 #[derive(Arbitrary, Debug, Clone, Copy)]
 enum Op {
-    AddAccount { code: u8, typ: u8 },
+    AddAccount { code: u8, typ: u8, placeholder: bool },
     CreateEntry { day: u8 },
-    AddLine {
-        entry: u8,
-        account: u8,
-        debit: bool,
-        cents: u32,
-    },
+    AddLine { entry: u8, account: u8, debit: bool, amount: Amount },
+    Pair { entry: u8, debit: u8, credit: u8, amount: Amount },
+    AddLineFx { entry: u8, account: u8, debit: bool, foreign: Amount, rate: Amount },
     PostEntry { entry: u8 },
-    ReverseEntry { entry: u8 },
+    ReverseEntry { entry: u8, day: u8 },
+    CreatePeriod { start: u8, len: u8 },
+    ClosePeriod { period: u8 },
+}
+
+/// A decimal from raw parts: any mantissa up to 96 bits, any scale 0-28.
+#[derive(Arbitrary, Debug, Clone, Copy)]
+struct Amount {
+    lo: u32,
+    mid: u32,
+    hi: u32,
+    negative: bool,
+    scale: u8,
+    small: bool,
+}
+
+impl Amount {
+    fn get(self) -> Decimal {
+        if self.small {
+            // Mostly ordinary money, so entries balance and post.
+            return Decimal::new(i64::from(self.lo % 1_000_000), 2);
+        }
+        Decimal::from_parts(self.lo, self.mid, self.hi, self.negative, u32::from(self.scale % 29))
+    }
 }
 
 fn account_type(t: u8) -> AccountType {
@@ -35,67 +56,79 @@ fn account_type(t: u8) -> AccountType {
     }
 }
 
-fuzz_target!(|ops: Vec<Op>| {
-    let mut ledger = Ledger::new(Currency::USD);
-    let mut entry_ids: Vec<u64> = Vec::new();
-    let mut next_code: u32 = 1000;
+fn day(d: u8) -> NaiveDate {
+    NaiveDate::from_ymd_opt(2026, 1, 1).unwrap() + chrono::Days::new(u64::from(d % 200))
+}
 
-    for op in ops {
+fuzz_target!(|ops: Vec<Op>| {
+    let mut l = Ledger::new(Currency::USD);
+    let mut entries: Vec<u64> = Vec::new();
+    let pick = |v: &[u64], i: u8| v.get(i as usize % v.len().max(1)).copied();
+    for op in ops.into_iter().take(200) {
+        let accounts: Vec<u64> = l.chart().all().map(|a| a.id).collect();
         match op {
-            Op::AddAccount { code, typ } => {
-                // Unique codes by construction; duplicates are rejected.
-                let c = format!("{:04}", next_code + (code as u32 % 50));
-                next_code += 1;
-                let _ = ledger.add_account(&c, "fuzz", account_type(typ), None, false);
+            Op::AddAccount { code, typ, placeholder } => {
+                let _ = l.add_account(&format!("{}", 1000 + u32::from(code % 40)), "f", account_type(typ), None, placeholder);
             }
-            Op::CreateEntry { day } => {
-                let date =
-                    NaiveDate::from_ymd_opt(2026, 1, 1 + (day as u32 % 28)).unwrap();
-                let id = ledger.create_entry(date, "fuzz");
-                entry_ids.push(id);
+            Op::CreateEntry { day: d } => {
+                if let Ok(id) = l.try_create_entry(day(d), "f") {
+                    entries.push(id);
+                }
             }
-            Op::AddLine {
-                entry,
-                account,
-                debit,
-                cents,
-            } => {
-                if entry_ids.is_empty() {
-                    continue;
+            Op::AddLine { entry, account, debit, amount } => {
+                if let (Some(e), Some(a)) = (pick(&entries, entry), pick(&accounts, account)) {
+                    let side = if debit { Side::Debit } else { Side::Credit };
+                    let _ = l.add_line(e, a, side, Money::new(amount.get(), Currency::USD));
+                }
+            }
+            Op::Pair { entry, debit, credit, amount } => {
+                if let (Some(e), Some(a), Some(b)) =
+                    (pick(&entries, entry), pick(&accounts, debit), pick(&accounts, credit))
+                {
+                    let m = Money::new(amount.get(), Currency::USD);
+                    let _ = l.add_line(e, a, Side::Debit, m);
+                    let _ = l.add_line(e, b, Side::Credit, m);
+                }
+            }
+            Op::AddLineFx { entry, account, debit, foreign, rate } => {
+                if let (Some(e), Some(a)) = (pick(&entries, entry), pick(&accounts, account)) {
+                    let side = if debit { Side::Debit } else { Side::Credit };
+                    let _ = l.add_line_fx(e, a, side, Currency::EUR, foreign.get(), rate.get());
                 }
-                let eid = entry_ids[entry as usize % entry_ids.len()];
-                // Account ids are 1-based; may not exist — rejection is fine.
-                let aid = (account as u64 % 60) + 1;
-                let side = if debit { Side::Debit } else { Side::Credit };
-                let amount = Decimal::new((cents % 1_000_000) as i64, 2);
-                let _ = ledger.add_line(eid, aid, side, Money::new(amount, Currency::USD));
             }
             Op::PostEntry { entry } => {
-                if entry_ids.is_empty() {
-                    continue;
+                if let Some(e) = pick(&entries, entry) {
+                    let _ = l.post_entry(e);
                 }
-                let eid = entry_ids[entry as usize % entry_ids.len()];
-                let _ = ledger.post_entry(eid);
             }
-            Op::ReverseEntry { entry } => {
-                if entry_ids.is_empty() {
-                    continue;
+            Op::ReverseEntry { entry, day: d } => {
+                if let Some(e) = pick(&entries, entry)
+                    && let Ok(r) = l.reverse_entry(e, day(d), "f")
+                {
+                    entries.push(r);
+                }
+            }
+            Op::CreatePeriod { start, len } => {
+                let _ = l.create_period("p", day(start), day(start.saturating_add(len % 60)));
+            }
+            Op::ClosePeriod { period } => {
+                let ids: Vec<u64> = l.list_periods().iter().map(|p| p.id).collect();
+                if let Some(p) = pick(&ids, period) {
+                    let _ = l.close_period(p);
                 }
-                let eid = entry_ids[entry as usize % entry_ids.len()];
-                let _ = ledger.reverse_entry(
-                    eid,
-                    NaiveDate::from_ymd_opt(2026, 12, 31).unwrap(),
-                    "fuzz reversal",
-                );
             }
         }
     }
-
-    // THE invariant: no sequence of operations, valid or rejected, may
-    // leave the trial balance out of balance.
-    let tb = ledger_core::reports::trial_balance(&ledger);
-    assert_eq!(
-        tb.total_debits, tb.total_credits,
-        "trial balance broken after fuzzed op sequence"
-    );
+    let tb = ledger_core::reports::trial_balance(&l);
+    assert_eq!(tb.total_debits, tb.total_credits, "trial balance broken");
+    for e in l.posted_entries() {
+        assert!(e.validate(l.chart()).is_ok(), "posted entry {} invalid", e.id());
+    }
+    for id in 1..l.next_entry_id() {
+        if let Some(e) = l.get_entry(id)
+            && e.status() == EntryStatus::Draft
+        {
+            assert!(l.closed_period_containing(e.date()).is_none(), "draft in a closed period");
+        }
+    }
 });
diff --git a/fuzz/fuzz_targets/fuzz_store_open.rs b/fuzz/fuzz_targets/fuzz_store_open.rs
new file mode 100644
index 0000000..0847c85
--- /dev/null
+++ b/fuzz/fuzz_targets/fuzz_store_open.rs
@@ -0,0 +1,14 @@
+// Fuzz target: a journal file on disk is untrusted input (a bad backup, a
+// hand edit, disk corruption). Opening books from arbitrary journal bytes
+// must return an error, never panic, and never hang.
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    let dir = std::env::temp_dir().join(format!("wb-fuzz-open-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    std::fs::write(dir.join(ledger_store::JOURNAL_FILE), data).unwrap();
+    let _ = ledger_store::Store::open(&dir);
+});
diff --git a/fuzz/seeds/fuzz_core_serde/entry.json b/fuzz/seeds/fuzz_core_serde/entry.json
new file mode 100644
index 0000000..9c61876
--- /dev/null
+++ b/fuzz/seeds/fuzz_core_serde/entry.json
@@ -0,0 +1 @@
+{"id":1,"date":"2026-01-15","description":"seed","lines":[{"account":1,"side":"Debit","amount":{"amount":"12.34","currency":"USD"}},{"account":2,"side":"Credit","amount":{"amount":"12.34","currency":"USD"}}],"status":"Posted","reversal_of":null}
\ No newline at end of file
diff --git a/fuzz/seeds/fuzz_core_serde/money.json b/fuzz/seeds/fuzz_core_serde/money.json
new file mode 100644
index 0000000..89d4bf1
--- /dev/null
+++ b/fuzz/seeds/fuzz_core_serde/money.json
@@ -0,0 +1 @@
+{"amount":"12.34","currency":"USD"}
\ No newline at end of file
diff --git a/fuzz/seeds/fuzz_journal_line/line_added.json b/fuzz/seeds/fuzz_journal_line/line_added.json
new file mode 100644
index 0000000..2092f28
--- /dev/null
+++ b/fuzz/seeds/fuzz_journal_line/line_added.json
@@ -0,0 +1 @@
+{"payload":{"account":1,"amount":"12.34","currency":"USD","id":1,"side":"debit"},"prev":"x","seq":2,"ts":"2026-01-01T00:00:00Z","type":"entry.line_added"}
\ No newline at end of file
diff --git a/fuzz/seeds/fuzz_journal_line/store_created.json b/fuzz/seeds/fuzz_journal_line/store_created.json
new file mode 100644
index 0000000..2b50efb
--- /dev/null
+++ b/fuzz/seeds/fuzz_journal_line/store_created.json
@@ -0,0 +1 @@
+{"payload":{"base_currency":"USD"},"prev":"0000000000000000000000000000000000000000000000000000000000000000","seq":1,"ts":"2026-01-01T00:00:00Z","type":"store.created"}
\ No newline at end of file
diff --git a/fuzz/seeds/fuzz_store_open/one_line.jsonl b/fuzz/seeds/fuzz_store_open/one_line.jsonl
new file mode 100644
index 0000000..2b50efb
--- /dev/null
+++ b/fuzz/seeds/fuzz_store_open/one_line.jsonl
@@ -0,0 +1 @@
+{"payload":{"base_currency":"USD"},"prev":"0000000000000000000000000000000000000000000000000000000000000000","seq":1,"ts":"2026-01-01T00:00:00Z","type":"store.created"}
\ No newline at end of file
diff --git a/justfile b/justfile
index c0383d1..ceb488e 100644
--- a/justfile
+++ b/justfile
@@ -40,12 +40,34 @@ prove:
     fi
     echo "Lean: $(wc -l <<<"$audit") headline theorems, standard axioms only"
 
-# Cross-check against GnuCash (an oracle, never the spec): random books through
-# wanderbooks and through GnuCash 5.10 in a pinned container. Needs Docker.
+# Random books through wanderbooks and GnuCash 5.10, compared exactly (Docker)
 oracle:
     docker build -q -t wanderbooks-gnucash-oracle oracle/gnucash
     cargo test -p ledger-core --test oracle_gnucash -- --ignored --nocapture
 
+# Fuzz one target for some seconds (nightly; corpus in fuzz/corpus/<target>)
+fuzz target="fuzz_op_sequence" seconds="300":
+    #!/usr/bin/env bash
+    set -euo pipefail
+    # Call the binary directly: mise's shim would pin stable rustc.
+    fuzz=$(mise which cargo-fuzz)
+    cd fuzz && mkdir -p corpus/{{target}} seeds/{{target}}
+    # corpus/ grows (git-ignored); seeds/ holds the checked-in minimal inputs.
+    RUSTUP_TOOLCHAIN=nightly-2026-10-01 "$fuzz" fuzz run {{target}} corpus/{{target}} seeds/{{target}} -- \
+        -max_total_time={{seconds}} -timeout=10 -rss_limit_mb=2048
+
+# Undefined-behavior check of the core's tests under Miri (nightly)
+miri:
+    PROPTEST_CASES=4 MIRIFLAGS="-Zmiri-disable-isolation" cargo +nightly-2026-10-01 miri test -p ledger-core --lib --test kernel_bridge --test invariants
+
+# Mutation testing of the core: do the tests catch planted bugs?
+mutants:
+    cargo mutants -p ledger-core --exclude crates/ledger-core/src/proofs.rs -j 4 --timeout 120
+
+# Benchmarks of the core's hot paths (no budget gates them yet)
+bench:
+    cargo bench -p ledger-core --bench books
+
 # Build the release binaries (CLI, MCP server, GUI)
 build:
     cargo build --release -p ledger-cli -p ledger-mcp -p ledger-gui
diff --git a/mise.toml b/mise.toml
index 2ca9114..31144ca 100644
--- a/mise.toml
+++ b/mise.toml
@@ -3,7 +3,11 @@
 
 [tools]
 # Workspace toolchain (clippy and rustfmt for `just check`).
-rust = { version = "1.99", components = "clippy,rustfmt" }
+rust = [
+  { version = "1.99", components = "clippy,rustfmt" },
+  # Fuzzing (cargo-fuzz) and Miri need nightly; pinned so runs repeat.
+  { version = "nightly-2026-10-01", components = "miri,rust-src" },
+]
 just = "1"
 # `just deploy` runs the Netlify CLI through npx.
 node = "26"