Context
Once internal workers exist behind a BFF, the next confusion is treating a delivered message as a repayment. Message delivery and double-entry state are different facts. Reconciliation has to survive a broker outage without inventing money.
This note is the ledger side of Mobility Finance Event Platform. The public-boundary decision is why the BFF is the only public boundary.
Decision
Double-entry repayment state is stored separately from broker delivery. Workers consume internal events; they do not become the accounts. Recovery is a command: make recovery-drill exercises a broker outage and the path back to a consistent ledger, not a replay that posts twice.
What I rejected
Using the bus (or an in-memory queue) as the loan book, and marking a repayment posted because the broker said delivered. Delivery is transport. The posting is a ledger row with its own idempotency.
Failure scenario
The broker is down. In-flight work is not silently posted. After the drill, duplicate delivery of the same event does not create a second repayment. In-memory persistence is an explicit current boundary, documented next to the recovery drill.
Evidence
make recovery-drill, recovery notes, and architecture that keeps domain services off the public network. Synthetic data only; no real lending, payment collection, or device control.
Inspect: Repository · Recovery drill · Architecture