Conversation
Add defined types (LedgerID, SubledgerID, AccountID, TransactionID, EntryID, HoldID) so map keys and method parameters clearly communicate what kind of identifier they expect. These are defined types (not aliases), giving compile-time safety against mixing e.g. a HoldID where an AccountID is expected. Change all public Service methods to return value types instead of pointers to internal state. This prevents callers from accidentally mutating the service's data. Transaction returns use a deep copy helper (copyTransaction) that copies the Entries slice and Metadata map. GetSnapshot now returns ErrSnapshotNotFound instead of nil when no snapshot exists for the given parameters. https://claude.ai/code/session_01947Cs6jqVPDDzmAqQMoB35
PostTransaction and CreateHold now check that the available balance (book minus active holds) would not go negative for Asset and Expense accounts. Liability, Equity, and Revenue accounts are not checked. https://claude.ai/code/session_01947Cs6jqVPDDzmAqQMoB35
raphi011
added a commit
that referenced
this pull request
Aug 6, 2026
Both customers bank at the same institution, so the money moves between
two of that bank's own deposit accounts. No interbank obligation comes
into existence: nothing to net, no reserves to move, and no camt.053 that
could tell a bank about a book it already holds. A real bank recognises
the beneficiary as its own and books it internally; it never reaches a
scheme.
Submitted to clearing anyway it produced three wrong answers, one per
institution. SettleReturnTx emitted two statements for the SAME book,
account and Reference differing only in sign, and PostSettlementAdviceTx
dedupes on (Book, Reference, Asset) — so the second was swallowed:
camt.053 #1 to AURODEFFXXX: account=200.100.001 reference="pay_13" movement=-250000
camt.053 #2 to AURODEFFXXX: account=200.100.001 reference="pay_13" movement=250000
central bank's record of this bank's reserve: 250000 -> 250000
the bank's OWN reserve mirror: 250000 -> 0
the bank's clearing suspense after the return: -250000
The nostro/vostro pair the README makes load-bearing off by the full
amount, and a permanently negative suspense. Second, the returning bank
was the returner on BOTH legs, so it refused its own customer's
unconditional eight-week refund. Third — pre-existing, outside this
branch's diff — a cycle holding nothing but an on-us payment nets to zero
and strands at Cleared for ever.
Each is a symptom of an instruction that should never have reached a
clearing house, so it is refused at the one door every submission comes
through, before the submitting bank's half runs. Patching SettleReturnTx
would have treated a symptom and left the Cleared strand standing.
Separately and regardless, PostReturnLegTx's mayRefuse is now a property
of the LEG: the clawback is refusable when the scheme is a push AND this
bank is the returner, and the refund never is. Asking only "is this bank
the returner" was true of both legs when one bank is both parties, which
is the inversion above. Stated correctly it no longer depends on the
boundary check holding — the defence in depth ReadReturn's id guard and
SettleReturnTx's own copy of it already use.
Measured before the fix: both a credit transfer and a collection between
two customers of one bank were accepted (Submit = <nil>), and the on-us
pull return came back "AURODEFFXXX cannot fund its own leg of the return:
insufficient available balance".
A book transfer between two customers of one bank is a real product and
belongs in its own task; the refusal says so rather than implying the
payment is illegitimate.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.