# Validation evidence — Idempotent Journal Posting

Reviewed 25 October 2026, Africa/Cairo. Private local package; no release-manifest change, remote publication or rendered video is claimed. Article and scene script derive from README and its propagation checklist.

## Executable reference evidence

Command: `python tests/run_tests.py` from this package.

- Four Python unittest methods passed, including the 87-case shared fixture loop, independent full canonical outcome, defensive-copy check, 40 snapshot-restored retries, and demonstration that independent snapshots do not serialize writers.
- TypeScript compiled with the installed compiler and all shared case assertions passed.
- **87 scenarios / 106 transitions** matched complete Python/TypeScript snapshots and response structures, including success, replay, rejection, exact large values, null states and reason codes. [Machine result](validation-results.json).
- Counts/reasons and selected exact totals/normal movements were specified from the Stage 0 independent oracle rather than generated from either implementation. `16 × (10^30−1) = 15999999999999999999999999999984` checks aggregate precision beyond the per-leg bound.

Coverage includes same-command restore/replay, object-key ordering, changed amount/journal ID/ordered legs/effective/source/booking fields/destination, journal-ID reuse, new success, policy/clock changes, scope denial before result disclosure, recording-time regression, failed attempt without accepted identity, malformed state linkage, all independent accounting cases, invalid money syntax, missing/unknown fields, year zero/leap seconds, maximum amount/count and explicit authorized current-period adjustment.

## Actual PostgreSQL evidence, separately bounded

The storage owner executed the companion [PostgreSQL 18 profile](/banking-ledger-and-reconciliation/tamper-evident-ledger-integrity/append-only-journal-enforcement/) through run_postgresql.py. [Raw observed result](postgresql-results.json) reports **24 passing named groups** on PostgreSQL **18.1**, a new task-owned cluster bound to loopback port 55430, logged storage with fsync/full_page_writes/synchronous_commit on, and a distinct restricted runtime login. Existing PostgreSQL services were not test targets. The task cluster was stopped and removed.

Relevant groups independently recorded actual sessions for:

| Group | Observed boundary |
|---|---|
| DB03 / DB04 | Rollback/disconnection before commit leaves no accepted identity/counter effect |
| DB05 | Accepted result retained after deliberately discarded response |
| DB06 | Two independent identical arrivals resolve one accepted journal/result |
| DB07 | Waiting duplicate can become writer when first transaction rolls back |
| DB08 / DB08b | Changed caller journal ID/concurrent command or ordered legs conflict |
| DB09 / DB09b / DB09c | Authorized scopes are independent; unauthorized replay/read discloses no result |
| DB10 | Per-ledger row lock orders committed counters |
| DB18 | Original result replay occurs before changed account/period policy |
| DB16 | Accepted identity survives controlled process restart |

The SQL result envelope differs from portable transition diagnostics; each adapter preserves its own exact stored original result. The baseline uses Read Committed plus an explicit ledger lock. No actual Serializable-error/retry test is claimed. Process restart is not hardware power-loss proof. Owner/administrator/infrastructure authority is outside the runtime append-only guarantee. These runs establish no reliability percentage, global compliance or independently retained history.

## Visual and lab evidence

Command: `node tests/visual-qa.mjs` from this package, using the available task browser runtime. [Machine result](visual-qa-results.json).

- Six scenarios × three widths (390, 768, 1440) passed expected decisions and document-overflow checks: exact lost-response retry, changed amount, later account/period closure, unauthorized retry, huge integer, and reordered legs.
- All scenarios traverse ten meaningful events with an inspectable register/audit table. Back/Reset boundaries, parameter reset, invalid-parameter blocking, Play/Pause, reduced-motion one-step Play, native control targets ≥44px, and no page errors/console warnings were checked.
- SVG and Mermaid were rendered and visually inspected. Lab screenshots at mobile/desktop were inspected for legibility and clipping. The SVG is rendered in an HTML wrapper to avoid the browser's native-SVG full-page screenshot timeout; the source remains standalone valid XML.
- Screenshots: [390px](qa/lab-390.png), [768px](qa/lab-768.png), [1440px](qa/lab-1440.png), [static SVG](qa/identity-svg.png), [Mermaid](qa/mermaid.png).
- Package validator: 0 errors, 0 warnings. Guided-playground validator: 1 passed, 0 failed. These are structural checks and do not replace the browser observations above.

Root performs isolated visitor article/iframe/build/asset acceptance after package integration. Standalone QA does not claim that downstream gate has passed. Final acceptance evidence is in the shared Stage 0/1 production report.

## Root visitor acceptance receipt

Reviewed2026-10-25. An isolated copy of the real visitor website passed production build, TypeScript, governed content and breadcrumb checks. This topic's article and standalone/embedded lab returned HTTP200 at390/768/1440px; H1, inline images, rendered Mermaid, public evidence links, control targets>=44px and reader/iframe containment passed. Browser application errors:0. Original website working files were untouched.

One pre-existing host iframe warning is recorded per embedded lab: the host combines allow-scripts and allow-same-origin sandbox tokens. It remains an explicit host-configuration limitation before publication; these content packages do not claim to resolve host security policy. Standalone package labs have no console warnings/errors. No remote publication or rendered video is claimed.

Raw proof: reports/domain-production/2026-10-24-D30-stage-0-1/{visitor-build-results.json,visitor-qa-results.json}. A preview-only native image-worker workaround reused cached cards and rendered missing cards serially after the original concurrent renderer crashed. It does not change algorithm behavior or the website checkout.