A hold is not a boolean. It is a ledger entry.

A business customer had 97% of their balance locked. Zero open operations.

It was not a balance bug. It was a definition bug.

Here is how it was built: when an order used the wallet, the system created a payment-detail record. When the order closed, the release routine looked for that record to know how much to return. That collateral field was the only evidence that anything had been reserved.

Then a new flow came in. It did everything the business asked of it: it charged correctly, completed the order, left the customer happy. It simply did not create that record.

Result: orders finished perfectly and the release found nothing to release. Weeks of holds, not one refund. The balance froze little by little, without a single error in the logs.

If "how much is reserved" is inferred by looking at side tables, every new flow anyone writes is an opportunity to break the calculation silently. The person writing the new flow does not even know the rule exists.

With double-entry, a hold stops being an inference:

• Hold = an entry moving balance from "available" to "held". Two postings, netting zero.
• Release = another entry, in the opposite direction.
• "How much is held?" = a balance, not a hopeful JOIN.

And most importantly: if a new flow holds and never releases, the money is still there, in a named account, with its entry and its date. It does not vanish inside a condition nobody remembers.

The guard we later wrote to detect stranded reservations carried the same original flaw: it joined against the reservations table. Holds with no reservation row were invisible to it. A detector built on the very assumption that caused the problem detects nothing.

If your system holds other people’s money, the question is not "do we have holds?". It is: can I list every active hold with its ledger entry, without looking at an operational table?

If the answer needs a JOIN, you already know where the next frozen balance will show up.

(LedgerCore, what I am building, treats holds and releases as first-class entries for exactly this reason.)