A three-way payment reconciliation that can recompute any past month byte for byte.

Walkthrough

Six decisions, each one defended.

1. 01 · three sources

   Two-way matching leaves blind spots

   Each source sees a different part of the same money’s journey. The ledger says what customers paid, the processor’s report says what it kept and how it bundled payouts, and only the bank statement shows cash received. Three of the five problems planted in the demo month are invisible to a two-way match:

   • Ledger and processor agree that payout PO-20260914 (EUR 1,752.23) was paid. Only the bank shows it never arrived.
   • The ledger says EUR 316.85 and the bank received EUR 311.76. Only the processor’s report splits that into a EUR 4.69 fee and a real EUR 0.40 shortfall.
   • One bank credit of EUR 10,624.87 pays for 50 card payments. Only the processor’s report says which 50.

2. 02 · import

   The same file cannot be imported twice

   Every file gets a fingerprint, so the same statement can’t be imported twice under a different name. (The fingerprint is a SHA-256 the database computes itself, so the uploading program can’t supply a false one.)

   A file the parser rejects is kept as evidence, with the reason written down, and can never be used in a reconciliation. A rejected file is a recorded outcome, not a crash.

3. 03 · matching

   Every row ends up in exactly one place

   Every row lands in exactly one place, and the database double-checks every match’s arithmetic before a run can finish.

   Matches on the demo month

   65, including one 50-to-1 deposit

   Sent to a person

   7 exceptions: 4 planted, 3 timing

4. 04 · exceptions

   Decisions are added, never edited

   Every break reaches a queue with a plain-language explanation and the evidence rows behind it. Resolving one takes a reason code and a note. The database refuses any change or deletion: a correction is a new entry that supersedes the old one, and both stay visible. If two people resolve the same item at once, exactly one gets through and the other is told who was first.

   The cost: in the demo, anyone can sign in as any synthetic account, and one person can resolve and then correct their own decision. Real use needs real authentication and a preparer/approver rule.

5. 05 · jobs

   A bad file can’t jam the queue

   A file that crashes the system can’t jam it. The failure is logged, and only a controller can retry it.

6. 06 · replay

   Any month can be recomputed and proved identical

   The engine uses nothing but the three stored files and its own version: never the clock, the database, randomness or the machine’s settings, and a test inspects its code for any of these. A replay is recorded as a new run, linked to the original, and shown as identical or different. A difference is kept as evidence, never discarded. Every daily reset of the public demo checks that the demo month still reproduces exactly.