Pull the plug.

Pick a moment in the middle of a payment. The API arms that point, takes a payment, and kills itself with SIGKILL when it gets there: no cleanup, no goodbye. The terminal does what a real one would do and retries with the same idempotency key until it gets an answer. Then the invariant checker reads the books.

Where should it die?

Balances lockedThe balance rows are locked; the journal is not written yet.post.after_lockThe bank said yesThe provider captured the money; nothing is recorded yet.attempt.after_pspBefore the first COMMITThe idempotency key is claimed but the claim is not committed yet.transaction.before_commitAfter the first COMMITThe key is claimed and committed; nothing else has happened.transaction.after_commitBefore the key remembersThe payment is done; its idempotency key has not stored the answer.request.before_finish

One plug a minute for everyone; the checks at most every 10 s.

The bank's weather.

The bank is simulated, so it can be told to misbehave. Make it flaky or start a storm, then watch the live page: payments still settle once, the recovery job asks the bank what really happened, and the next settlement day shows the breaks reconciliation found.

Asking the bank…

A flaky bank or a storm lasts 5 minutes and can be started once a minute for everyone. An ordinary day can be brought back any time.