A class-of-bug fix: CHECK constraints make invalid money states impossible at write time, and an invariant suite continuously proves the books balance across every account and party. The checks gate the build and run on an hourly schedule, surfacing to an admin health view. Money correctness is enforced by the system, not by hoping.