Reconciliation by design: ledgers that always balance

Most financial bugs are not dramatic. They are a few cents that drift apart between two systems over a month, discovered when someone tries to close the books and the totals refuse to agree. By then the cause is buried under a million transactions. Reconciliation done as an afterthought is archaeology. Done as a design principle, it is arithmetic that cannot lie.

Double-entry is not optional

Every movement of money is recorded as balanced debits and credits against accounts, and the invariant is absolute: for any transaction, debits equal credits, and the sum of every balance in the system is zero. Money is never created or destroyed, only moved between accounts — including external ones that represent the bank, the processor, or the customer's card. If a single entry would break the balance, the whole transaction is rejected. This is not bookkeeping nostalgia; it is the cheapest invariant you will ever get for detecting that something went wrong.

We make the ledger append-only. Entries are never updated or deleted — a mistake is corrected with a compensating entry that reverses it, leaving both the error and its fix visible forever. This gives every balance a derivation: it is the sum of its entries, reproducible from scratch at any point in time. When a number looks wrong, we do not guess; we replay the entries and watch where the truth diverges from expectation.

Reconcile against the outside world

Internal consistency is necessary but not sufficient. The ledger also has to agree with reality — the processor's settlement file, the bank statement, the wallet provider's report. We import those external records and match them line by line against our own entries, flagging anything that appears on one side but not the other. A charge we recorded that the processor never settled, or a payout the bank shows that we never booked, surfaces within hours instead of at month-end. The matching runs continuously, and unmatched items go into an exceptions queue with enough context for a human to resolve them quickly.

A ledger you reconcile once a month is a ledger that is wrong for a month before you find out.

— Protocore · Backend engineering

The discipline pays for itself the first time an auditor, a regulator, or an angry customer asks where a specific euro went. Because the ledger is balanced by construction and reconciled continuously, the answer is a query, not an investigation. Building this in from day one costs more than a naive `balance += amount` column. It costs far less than rebuilding your financial history under pressure after the numbers have already stopped adding up.