The only thing on the platform that moves money.
Double-entry balances on a dedicated ledger, reached through typed commands, with exactly-once semantics and an explicit state for the case where the answer never came back.
Wallet, precisely
Typed commands only
Deposit, wager reserve/settle/cancel/rollback, withdrawal reserve/complete/cancel. There is no generic transfer and no set-balance endpoint.
Cannot go below zero
An overdrawing instruction is refused by the ledger itself, not caught by a validation layer that somebody could bypass.
Exactly once
Deterministic identifiers and exact-receipt replay, so a retried request, a dropped connection or a double click cannot settle twice.
Ambiguity is a state
When a call returns no terminal result the operation is neither committed nor rejected. A fenced reconciler resolves it only on exact evidence.
Holds
Reserved money counts as unavailable, so a balance cannot be spent while a payout against it is still in flight.
Bonus pockets
Bonus liability sits in its own account family and moves only by typed award, conversion or forfeiture command.
Every module on this platform is defined as much by what it is forbidden to do as by what it owns. That is what makes a boundary auditable instead of aspirational.
Every other module on this platform plans an effect. Only the wallet performs one.
See it running
Every module here surfaces as screens an operator uses on a Monday. Ask for a walkthrough of the ones that decide your week.