Decision, pending reservation and account records
Pending money is a row, not a gap
decision once, reservation visible, legs settle separately
the three records:
Account
id, balance
one row per shard leg
legs land separately
sum check proves total
settles
PendingReservation
payment_id, amount
in-flight money is a row
released only by settle
crash leaves it visible
allows
PaymentDecision
payment_id is the key
written once, never changed
restart re-reads it
no second verdict
what readers can and cannot see:
legs land separately
reader sees dst before fee
that is normal, not a bug
pending is always visible
ledger shows reserved funds
nothing vanishes mid-flight
no atomic snapshot
convergence is not visibility
final does not mean instant
legend: blue = per-leg state, yellow = money in flight, purple = the one durable verdict
integrity means conserved totals plus visible pending, not all-legs-at-once