The Rowan household · Ledgerglass

privacy-safe test record

The feed missed three purchases

What happened: A connected credit card stopped including several posted purchases near the end of a closed cycle.
Why it was difficult: The balance was real, but the transaction feed could not explain it.
Evidence on hand: immutable provider observations
complete synthetic statement
opening and closing balance arithmetic
What Ledgerglass changed: Ledgerglass matched supported rows, added three statement overlays, and left one uncertain provider row out of the effective cycle.
What stayed uncertain: The uncertain row remains visible for later provider or owner evidence.
How it reverses: A later exact provider transaction replaces its overlay without deleting the statement observation.

privacy-safe test record

What happened: One row on a complete synthetic statement had the same amount, calendar date, and normalized text as two posted provider rows.
Why it was difficult: Choosing the first identifier would make a deterministic result look authoritative while hiding a real one-to-many collision.
Evidence on hand: immutable statement row
all candidate ledger identifiers
candidate count
exact amount, date, and text factors
What Ledgerglass changed: Ledgerglass kept the connected statement and provider rows together, left all provider rows posted, and created an explainable owner-review ambiguity without adding an overlay or exclusion.
What stayed uncertain: The cycle remains partial until independent evidence supports one distinct active provider for every connected statement row and resolves every excess active candidate. The invariant applies to every connected ambiguity, not only exact-text collisions; equal-count interchangeable duplicates can still match one-to-one.
How it reverses: An atomic evidence-bound owner decision can close the whole component only after excess activity is handled. A later provider arrival refreshes a deficient component; invalidated assignments reopen for safe reassignment while immutable review history remains intact.

privacy-safe test record

What happened: A pending grocery authorization disappeared from later provider responses.
Why it was difficult: Absence does not prove cancellation, and counting it forever overstates spending.
Evidence on hand: first and last observation times
pending age
later posted candidates
What Ledgerglass changed: After the policy window, Ledgerglass marked it expired-assumed and removed it from operational totals.
What stayed uncertain: Expired-assumed is reversible bookkeeping, not a cancellation claim.
How it reverses: A fresh observation reactivates it; a unique posted match settles it.

privacy-safe test record

What happened: Two synthetic card statements each balanced internally, but the next opening balance was different from the prior closing balance.
Why it was difficult: Arithmetic inside each document could pass while the missing movement between cycles stayed unexplained.
Evidence on hand: stable statement-cycle identity
prior closing balance
next opening balance
immutable source versions
What Ledgerglass changed: Ledgerglass created one continuity discrepancy with the required adjacent-statement evidence and a deterministic resolution condition.
What stayed uncertain: No balancing transaction is invented and the difference remains waiting or owner-review work.
How it reverses: A corrected statement version can supersede the effective evidence; the old version and discrepancy history remain auditable.

privacy-safe test record

What happened: A noisy merchant string was repeatedly categorized as shopping instead of a subscription.
Why it was difficult: A broad text rule would also change unrelated merchants and contaminate evaluation rows.
Evidence on hand: owner correction
statement-printed merchant
impact preview
What Ledgerglass changed: Ledgerglass promoted an account-scoped exact rule after checking affected rows.
What stayed uncertain: The rule applies only to its proven scope.
How it reverses: A later authoritative contradiction suspends the rule and restores field provenance.

privacy-safe test record

What happened: One synthetic institution stopped refreshing while the other connections stayed current.
Why it was difficult: A single stale source should not turn known balances into invented totals or make every tool unusable.
Evidence on hand: per-account refresh cadence
last successful source observation
dated balance snapshots
What Ledgerglass changed: Ledgerglass kept current evidence usable and attached precise coverage warnings to affected answers.
What stayed uncertain: Any total containing the stale account is explicitly partial.
How it reverses: The next authenticated observation clears the stale condition without rewriting history.

privacy-safe test record

What happened: A vector-index write timed out after a successful transaction sync.
Why it was difficult: Retrying the whole sync could duplicate work while leaving the actual failed stage unclear.
Evidence on hand: successful ingestion batch
missing index job
stage-specific failure receipt
What Ledgerglass changed: The steward queued only the missing derived work and retried it independently.
What stayed uncertain: Semantic search stays marked incomplete until the retry succeeds.
How it reverses: Derived artifacts can be rebuilt from the canonical ledger.

privacy-safe test record

What happened: A synthetic household had a confirmed card payment, a statement-supported bill, and a recurring purchase pattern with no fixed amount.
Why it was difficult: Treating all three as equally certain would make the next balance look more precise than the evidence allows.
Evidence on hand: owner-confirmed schedule
closed statement fact
mature repeated observations
dated starting balance
What Ledgerglass changed: Ledgerglass kept committed, expected, and possible paths separate, expanded occurrences deterministically, and kept each currency on its own account path.
What stayed uncertain: The possible path is a scenario range, not a probability or a promise; missing balances and stale terms remain visible as coverage warnings.
How it reverses: Schedules and occurrence states are append-only derived expectations; changing an assumption creates a new revision without changing ledger evidence.

privacy-safe test record

What happened: A model confidently described a card payment as ordinary spending.
Why it was difficult: The prose was plausible, but it conflicted with a confirmed transfer relationship.
Evidence on hand: linked account movement
matching amount and dates
deterministic flow classification
What Ledgerglass changed: Ledgerglass kept the transfer classification and exposed the model output only as rejected derived evidence.
What stayed uncertain: Narrative confidence never outranks transaction relationships.
How it reverses: A confirmed owner correction can replace the relationship through the normal audited path.