---
id: ADR-ACC-REC-011
title: Reconciliation Keeps Its Own Append-Only Audit Trail
product_area: accounting
module: reconciliation
revision: 2
status: proposed
design_intent: proposed
source_sha:
  services-accounting: f47cb263875bbc0c5640fba7dae6785ec32695f8
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: >-
  Retain reconciliation activity in its own append-only store and expose that
  history through module reads.
constrains:
  - DOM-ACC-REC-001
  - DOM-ACC-REC-003
  - DOM-ACC-REC-004
  - SVC-ACC-REC-reconciliation
  - RESP-ACC
origin: services-accounting docs/reconciliation/architecture.md §18.3
alternatives:
  - option: Use only generic record history.
    why_not: >-
      The current module has not adopted it, and row changes alone do not
      capture refused approvals.
  - option: Publish lifecycle change events to consumers.
    why_not: >-
      Current consumers read within Accounting; notification-based reactions are
      not implemented.
consequences:
  - >-
    Activity retains actors, reasons, request context and bounded details rather
    than banking credentials.
  - >-
    Guard refusals are recorded, while later request-write failures can leave no
    attempt event.
  - >-
    Any shared-history migration must preserve access to existing financial
    evidence.
supersedes: []
evidence:
  - >-
    services-accounting at f47cb263:
    modules/reconciliation/db/reconciliation-events.table.ts;
    services/persistence/reconciliation-events.ts;
    docs/architecture/standard-adoption.md (events baseline).
---
# Reconciliation Keeps Its Own Append-Only Audit Trail

## Context

Reviewers need financial decisions and eligible refusals with their responsible actors.

## Decision

Retain reconciliation activity in its own append-only store and expose that history through module reads.

## Alternatives Considered

Use only generic record history. The current module has not adopted it, and row changes alone do not capture refused approvals.

Publish lifecycle change events to consumers. Current consumers read within Accounting; notification-based reactions are not implemented.

## Consequences

Activity retains actors, reasons, request context and bounded details rather than banking credentials. Guard refusals are recorded, while later request-write failures can leave no attempt event. Any shared-history migration must preserve access to existing financial evidence.