The guarantee
A funding intent reachessettled only when balanced double-entry records exist for it. A transaction hash is evidence that value moved. It is not evidence that your user should be credited.
This gives you three things that are otherwise hard to build:
Exactly once
Postings are keyed by intent and kind with a uniqueness constraint. A replayed webhook or a retried worker cannot double credit.
Reversible
Corrections are compensating entries, never deletions. History is append only.
Reconcilable
Balances are derived from entries, never stored as the authority. A continuous reconciler compares them and alerts on any divergence.
Balances as a destination
Settling torail: "ledger" credits an account we hold on your behalf rather than sending to a wallet:
What we hold, and where
We are non-custodial where the rail allows it and custodial in transit where it does not, and we say which per rail rather than glossing it.Every unit we hold has a named liability account. There is no off-ledger operational wallet anywhere in the system.

