Payment Checkout & Ledger Service  ·  View 20 of 24  ·  Operations

The Loop That Must Close

Believe, post, receive evidence, match, name the gap, correct, prove — then feed tomorrow.

Editable source SVG draw.io All views
Believe provider said approved Post entries sum to zero Receive evidence settlement file Match ref + amount Name the gap break account Correct dual control, opposite entry Prove trial balance + bank Books that balance every day natural key T+1 automatic unmatched aged 48 h new txn feeds tomorrow The Loop That Must Close — Reconciliation Application we own Data store External / third party Decision point Risk / gap Security / platform The loop is the only thing that makes an asynchronous ledger safe. If it ever stops closing, the platform is guessing. v 1.0 · owner Payments Platform Architecture · date 2026-10

Why this is a ring

  • An asynchronous ledger is only safe if this loop always closes. If it stops closing, the platform is guessing about money (ADR-07).
  • 'Name the gap' is the step most systems skip, by netting unmatched amounts away. A named break on the books is the difference between an unexplained rupee and a missing one.

Decisions

  • Correction is always a new opposite-signed transaction under dual control, never an edit (ADR-02, ADR-14).
  • 'Prove' is the daily trial balance plus a cash comparison against the bank, with a tolerance alarm. It is a gate on the payout run, not a report.

Risks

  • The loop's health is a leading indicator for every other correctness property in the set, and it runs once a day. A two-day outage of the matcher is a two-day blind spot that nothing else detects.
◀  Observability — Signal by Pipeline Stage All views Release and Rollout  ▶
Solution Architecture v1.0 · open source, self-hosted on Kubernetes across two in-country data centres · Payments Platform Architecture · 2026-10 · 24 views · 18 architecture decision records20-reconciliation-loop