CONTROLS / ELPIS
Reconciliation
Keeping the books and the chain in agreement — loudly, and never by silent repair.
The principle
A treasury whose records disagree with the chain cannot operate, so Elpis reconciles. The danger is how: absorbing a discrepancy into something that looks normal is fine for a human who closes the month and dangerous for a machine that never reviews anything.
- Reconciliation may adjust the books — but it can never do so quietly.
- Every adjustment writes an incident: what differed, by how much, and when.
- The incident stays visible on every page until a person records that they reviewed it.
Incidents
| Field | Meaning |
|---|---|
| what differed | Expected vs observed value, in base units. |
| direction | Which side the books moved toward. |
| detected at | When the mismatch was found. |
| reviewed | Set only by a person, and only from the console. |
Acknowledgement
The banner is not dismissible by timeout or navigation. It clears when a named person acknowledges it, and the acknowledgement is recorded.
Verification is separate
Reconciliation compares the books to the chain in aggregate. Verification confirms one action’s execution. Both read the chain; neither substitutes for the other. See Verifiability and the math.* and contract.* rules in Controls.