Evidence level: historically reviewed source and owner proposals; not freshly tested or certified for production.
Design and implementation invariants
- Financial balances and liabilities are maintained through an append-only ledger with exact decimal arithmetic and idempotent holds, debits, releases and credits.
- Uncertain provider, dispatch or database acknowledgements must reconcile the original operation rather than guess another debit/POST.
- Wallet and Commerce transaction linkage is an ownership and atomicity requirement, not merely proof that both components use YSQL.
Verification still required
- Verify narrow SQL grants, durable concurrent ledger invariants and loss-of-acknowledgement recovery against a real authorized YSQL transaction fixture.
- Prove multi-node consensus/failover and external provider idempotency separately; historical SQLite and single-node lab tests do not establish production behavior.
How to update
When the owner changes implementation or contract behavior, update this page and the relevant service interfaces. For cross-service changes, also update the platform interface map or decision register. State the actual verification performed; do not inherit historical pass claims without fresh evidence.