When the record lives inside the operator's system, what can an outside party actually verify?

A single payment of public money can cross more than one rail before it lands – a batch file settling to a bank account, an instant-payment leg completing the same obligation. The settlement receipt confirms the obligation was discharged exactly once across every declared rail leg, with a finality class echoed from the caller's own declared basis per rail.

A payment of public money is meant to land on a specific ministry, agency, or revenue code. The check runs that attribution against the caller's own revenue-code table, then compares what was credited against what was collected with every fee on its own line.

Public money that cannot be traced back to the budget line it came from is money nobody can account for at the end of the year. The failure is rarely dramatic. A fee gets absorbed into a difference, the difference is small, and the payment reconciles anyway.

A fee that only ever shows up inside the difference has not been disclosed. It has been hidden in plain sight, and the totals still agree.

A daily reconciliation attestation names its exceptions for the window it covers, and nothing in that duty forces a link to the next day's population. An item can be flagged today and simply absent tomorrow. Both days pass.

A break can age out of the record without anyone resolving it, because no single day's duty is built to look at the day before.

An administrator who edits a record, reverses an entry, or changes a permission is acting on the same system a payer's transaction passes through. If that action falls outside the logged chain, the trail has a hole that the transaction log itself will never show a reviewer.

The idea this question tests is not whether payer transactions are logged – they always are. It is whether the same unbroken chain also covers what an administrator did to the record.

Salaries, benefits, or vendor payments often go out as one bulk run. The check compares its itemised and aggregate totals against the authorisation record. A mismatch is recorded as a candidate for a human reviewer, never as a finding of wrongdoing.

Move a payment platform to a new system and the reassuring number is the grand total, which comes out identical. It can do that while one program has lost twenty-three records and another has gained twenty-three duplicates. Someone gets paid twice, someone else drops out of the programme entirely, and the migration signs off clean. Counting partition by partition, by program, by period, by agency, is what separates those two outcomes.

When an operator's contract ends or a platform is replaced, three things happen to the data: some goes to the successor, some stays with the outgoing operator under its own obligations, and some becomes stranded, reachable by nobody once the transition completes. The receipt evaluates that declared posture. It is not a live observation of what happens on the day.

What this evidences, and what it does not

Every node above computes over inputs the caller declares. Each receipt evidences that the computation ran correctly over those declared inputs – it says nothing about whether the declarations were true. The exit panel is the sharpest case: it evidences that a declared exit posture satisfies its own stated categories, not what the operator actually does with the data once the transition completes.