The revenue ledger and the KeyShop.

The revenue_ledger is the deliberate inverse of players: a signed delta with no non-negative guard (the house legitimately swings negative on the seed debit), no exactly-once index (each post is a distinct accrual), and its uniqueness is the RVL primary key alone. Every platform movement funnels through one primitive — house_post/5 mints one RVL row and touches no balance column, so it never hits players_non_negative and needs no player lock. The balance is the sum of these rows.

def house_post(account, currency, delta, reason, ref) do
  rid = EchoData.BrandedId.generate!("RVL")

  {:ok, _} =
    %RevenueLedger{}
    |> RevenueLedger.changeset(%{
      id: rid,
      account: account,        # "platform" — the sole account this rung
      currency: to_string(currency),
      delta: delta,            # SIGNED — negative on the deposit_seed debit
      reason: reason,
      ref: ref
    })
    |> Repo.insert()

  rid
end

The reconciliation reads never re-derive: house_balance/1 is a SUM(delta) GROUP BY currency over a table holding only platform movements — no player rows to exclude, the dedicated-table payoff — and revenue_breakdown/1 groups one game’s rows by reason. The conservation identity holds over three observable columns, explicitly not by a zero row-sum.

The order is the money’s: first the house’s own book (C6.1), then the pay-in that feeds it (C6.2), then the outward rail the design points at but has not built (C6.3). Scoring stays linear throughout; this chapter is money, not points.