Working on systems that move real money changes what "saved to the database" is allowed to mean. A row existing in Postgres is not the same claim as "this record is durable and this record is true." Here's the pattern I now apply to any code where a mutation has to be trusted after the fact — balances, ledgers, anything that gets audited.
One choke point, always
Every mutation of critical state — a credit, a debit, a transfer, a reversal — goes through exactly one audited function. Not "usually," not "except for this one admin shortcut." One function, and every caller, including internal tooling, goes through it. The moment a second code path can also mutate the balance, the ledger stops being a source of truth and becomes one of several competing opinions about what happened.
Caches are allowed to exist for read performance. They are never allowed to diverge from the ledger, and they're never the thing you trust when reconstructing history.
Append-only and hash-chained, not just "logged"
