---
id: ADR-ACC-REC-012
title: Money Commands Take Request Keys
product_area: accounting
module: reconciliation
revision: 2
status: proposed
design_intent: confirmed
source_sha:
  services-accounting: f47cb263875bbc0c5640fba7dae6785ec32695f8
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: >-
  Use scoped request keys for supported money commands, with claim-first
  creation paths and replay-and-store approval paths.
constrains:
  - SVC-ACC-REC-reconciliation
  - WF-ACC-REC-002
  - WF-ACC-REC-004
  - WF-ACC-REC-005
  - WF-ACC-REC-006
  - WF-ACC-REC-010
origin: >-
  ACCT-M8 plan §2 scope (idempotency of every money command), approved by Andrew
  2026-10-22; TC-PI-002
alternatives:
  - option: Rely only on expected versions.
    why_not: >-
      A lost successful response would become a stale refusal, while creation
      has no prior row version.
  - option: Use an early separate key claim for every approval command.
    why_not: >-
      The existing audited-guard protocol retains refusal evidence without
      leaving that claim behind.
consequences:
  - >-
    Matching retained bodies replay; changed bodies under a completed key are
    refused.
  - Accounting modules share the hosted request ledger and its cleanup.
  - >-
    Fresh console keys and unkeyed ancillary commands limit user-level retry
    protection.
supersedes: []
evidence:
  - >-
    services-accounting at f47cb263:
    modules/reconciliation/services/persistence/idempotency-keys.ts;
    services/batch-lifecycle/batch-commands.ts; react-console at baf6dae3:
    lib/accounting/reconciliation/client.ts.
---
# Money Commands Take Request Keys

## Context

Clients need to recover a completed financial outcome after losing its response.

## Decision

Use scoped request keys for supported money commands, with claim-first creation paths and replay-and-store approval paths.

## Alternatives Considered

Rely only on expected versions. A lost successful response would become a stale refusal, while creation has no prior row version.

Use an early separate key claim for every approval command. The existing audited-guard protocol retains refusal evidence without leaving that claim behind.

## Consequences

Matching retained bodies replay; changed bodies under a completed key are refused. Accounting modules share the hosted request ledger and its cleanup. Fresh console keys and unkeyed ancillary commands limit user-level retry protection.