Payment System

01What is the payment lifecycle we own — one-shot charge or authorize/capture/settle?

The full flow: authorize (hold funds), capture (commit), settle (money moves) — each step recorded, each step failable with a defined recovery.

02What does the merchant integrate against — us or the payment service provider (PSP)?

Us only: one stable API wraps the PSP; swapping or adding processors never leaks into merchant code.

03When a merchant asks "did it go through" — what answers?

Our ledger state, not a cached PSP echo: status reflects recorded events, and pending means pending — never a guess.

04What is the source of truth for money?

A double-entry ledger: every transaction posts balanced debit and credit legs, append-only — balances are derived, never edited.

05The client times out and retries — what stops a double charge?

An idempotency key on every payment-initiating call: the retry returns the original outcome; the key, not luck, is the guarantee.

06How do we know our numbers match the bank’s?

Daily reconciliation against PSP settlement files: every mismatch becomes a work item — silence is proof, not absence of checking.

01What can we lose in a crash?

Nothing: the payment intent is durably written before the PSP is called, so recovery always knows what was in flight — money steps are never in-memory-only.

02Fast or correct — where does this system sit?

Correct: seconds of latency are acceptable; a wrong charge, a lost cent, or an unbalanced ledger is not. The SLO is accuracy.

03Networks duplicate and reorder — how is exactly-once real?

It is an outcome, not a transport: at-least-once everywhere plus idempotent handlers keyed on stable ids — duplicates converge to one effect.

04What scale should the ledger sustain?

~10K TPS peak means ~20K+ balanced ledger legs per second, append-only — partitioned by account, never contended on hot balances.

05An auditor asks about one cent from last March — what happens?

Replay: immutable entries explain every balance historically; corrections are new compensating entries, never edits.