Section 5: Every Cent Has Two Sides - Ledger Design & Accounting Model

Executive Summary: Section 4 ended with "the ledger posts." This section builds that ledger, the subsystem the rest of the design leans on. We choose double-entry over balance columns, lay out the accounts with their normal balances, and post Maya's lamp through its life: a 5-leg capture, settlement, release, a ledger-first payout, plus the tea-set refund. Every entry is checked so its debits equal its credits. Then we walk the write path inside one shard transaction, keyed by seller_id, where each house account is split into 64 per-shard sub-accounts. That split keeps every journal transaction on one shard with no 2PC at 3,500 txn/s peak. Postings are immutable, corrections are reversals, and balances are a verified cache of the posting sum.

The interviewer circles "Ledger" on the architecture diagram. "Everything you've drawn so far moves messages. This box is supposed to prove where $600 million a day went. Show me."

Why Double-Entry, and Not a Balance Column

Interviewer: "Why not a balance column per seller? Add on capture, subtract on payout."

You: "Because a balance column can only tell you what the number is. It can't tell you why. Say a retry adds $70.40 twice. The column just reads $140.80, and nothing in the database contradicts it. In double-entry, every movement is a journal transaction of two or more postings, and its debits must equal its credits. Money is never created or destroyed. It only moves between named accounts. So an error has to show up somewhere: in a transaction that doesn't sum to zero, in a balance that disagrees with its postings, or in a trial balance that isn't zero."

A single-entry log of transactions is better than a bare column, but it still has no second side to cross-check, so it's rejected too (D3). This decision has no flip trigger. At $600M a day, 0.01% of untraceable error is $60k a day of money nobody can explain.

Key Insight: Double-entry isn't bookkeeping ceremony. It's an error-detecting code for money. The rule that every transaction sums to zero turns a silent bug into a broken invariant you can check.