Reconciliation systems decide, continuously, whether money the ledger expected has arrived at the bank. On an asynchronous stream that decision is taken against partial evidence: a credit that has not appeared may be missing, or may simply not have been posted yet. Deployed pipelines settle this with a timeout or a watermark, and the exceptions are treated as findings. We give a temporal correctness contract that says when such a verdict is admissible, relative to a declared per-source lateness bound, and a checker for it that needs no ground truth. The contract separates three things an operator otherwise sees only as a rising break rate: the reconciler decided too early, an input broke the bound it declared, or the money really is gone. On workloads from a published payment simulator, the standard remedy for a stalled streaming join, an idleness timeout, introduces contract violations on 5.42% of obligations (95% CI [3.94, 6.92]) on traffic where the same job without it is exactly sound, and violations vanish once the timeout reaches the slow source's posting period, as predicted. Under a lateness shift, all four identity-based reconcilers we test raise spurious breaks on between 18.3% and 23.0% of the credits the bank did settle, while their contract violation rate stays at or below 1.01%: the checker attributes the loss to 240 bank-side and 413 ledger-side bound violations rather than to the reconcilers. Tracking one horizon per source leaves break latency 12.7% lower on average and halves its tail (p99 224 against 446 ticks) at equal soundness, though it is not cheaper at every cost setting and we report where it loses. An Apache Flink interval join, written the ordinary way, violates the contract on 14.9--20.1% of obligations. The contract is expressible as SQL over the tables a reconciliation system already keeps, agreeing with the reference implementation on all 4,395 verdicts.

翻译：暂无翻译