The commercial objective of each step of the customer journey, the platform decisions behind it, the trade-offs accepted, and an honest account of the gap to production.
Every step has a commercial goal and a failure mode. The platform is designed around the failure modes.
| STEP | GOAL | RISK IF WRONG |
|---|---|---|
| 01Register | Lowest-friction entry that still proves age and state. | Abandonment; unlicensed-state exposure. |
| 02KYC | Verify once, unlock everything. | Drop-off; false rejects; manual-review leak. |
| 03First deposit | Convert verified to funded within the session. | Declines; limit friction. |
| 04Browse & select | Fast path to a first bet. | Stale prices; suspended markets. |
| 05Place | Atomic debit + record at an accepted price. | Duplicates; wrong-price disputes. |
| 06Settle | Exactly-once payout, visible immediately. | Late or double payouts. |
| 07Withdraw / RG | Money out as easy as in; controls that hold. | Failed transfers; weak exclusion. |
Each decision is visible in the lab and named in the architecture.
One function answers “may this account do this now?” for deposits, bets and withdrawals: age, licence, KYC, cooling-off, exclusion.
Trade-off: A single choke point needs an owning team and a fast read path.
See component →Balance is a sum of integer-cent entries, each with type, reference and creating key. Any balance is explainable from entries alone.
Trade-off: Forbids “just fix the balance” — the discipline that makes it trustworthy.
See component →Client key + canonical payload fingerprint: retries replay, reused key with a different payload conflicts. Settlement and reversals derive keys from bet / withdrawal ids.
Trade-off: Clients must generate and persist keys; cheap now, prohibitive to retrofit.
See component →Accepted price travels with the leg and must equal the live price at placement.
Trade-off: Lower acceptance in fast markets — chosen over silent repricing disputes.
See component →Limits at deposit; breaks and exclusions on every command; decreases immediate, increases wait 24h; withdrawals stay open under exclusion.
Trade-off: Revenue deliberately refused; the bet is that trusted books retain.
See component →Correlated legs overpay when multiplied. Without a correlation model the honest answer is to refuse — in placement and in reconciliation.
Trade-off: A major US revenue line, sequenced after a pricing model exists.
See component →A bet is placed through a fixed pipeline. Any refusal happens before money moves; any success is one debit and one record.
One choke point decides every money command. Responsible gaming is enforced there — not hidden in the app.
No user → self-exclusion → licensed state → KYC verified → cooling-off. The first failing rule returns its reason code.
Self-excluded and cooling-off customers can always take their money out.
Decreases apply immediately; increases wait 24 hours. Each deposit records the limit in force.
Breaks and exclusions live on a platform register that survives sign-out and re-binds on return. They can never be shortened.
Each scenario loads deterministically in the lab. The platform’s response is traced to reason codes and automated tests.
Denver ML taken at 1.80, now trading 1.65.
Placement refused until the customer accepts the new price; the accepted price becomes a new intent with a new key.
Trading suspends EV-2091 after the customer picked it.
$10 balance, $50 stake.
Refused with the derived balance quoted; the customer is offered a deposit.
INSUFFICIENT_FUNDSBP-09The same command arrives twice, or the same key with a different amount.
Exact replay returns the original result; a changed payload conflicts. No second debit or credit.
Four bets the UI could never build: unknown side, missing price, correlated legs, fractional cents.
Each refused with a reason code; zero ledger movement; reconciliation stays 13/13.
$75 held; the transfer fails at the bank.
Hold reversed exactly once (key rev:WD-…); repeated failure notices are ignored.
24h cooling-off active.
Deposits and bets refused centrally; withdrawals stay open; lifts when the clock passes.
COOLING_OFFRG-03Sam is on the register at registration.
365-day exclusion applied; only withdrawals available; restriction re-binds after sign-out.
Casey, 19, in PA.
Account never created; decision code shown and logged.
AGE_BLOCKIE-02Taylor lives in NY.
Blocked centrally at registration.
STATE_BLOCKIE-03Identity records do not match.
Browse-only; deposits and bets refused until manual review.
KYC_REQUIREDIE-04Watchlist near-hit.
Browse-only until an operator approves or declines from the Control Room.
Simulated values from this browser’s lab session sit next to the production metric they stand in for. They are deliberately kept separate.
| KPI | SIMULATEDthis browser | PRODUCTION METRIC (not measured here) | WHY IT MATTERS |
|---|---|---|---|
| Onboarding conversion | … | Visitors → verified accounts by state and channel | Blocked registrations are a cost of compliance; measure them so they are not “fixed” the wrong way. |
| KYC completion | … | % verified within 10 min; auto-approve vs manual review | Manual review is the largest onboarding leak in US books. |
| First-deposit conversion | … | Verified → funded within 24h; decline rate by method | Funded-in-session predicts 90-day value. |
| First-bet conversion | … | Funded → first settled bet within 7 days | A deposit without a bet is a refund waiting to happen. |
| Transaction success | … | Accepted ÷ attempted by reason code; duplicate incidents (target 0) | Reason codes separate healthy refusals from defects. |
| Settlement accuracy | … | Resettlements per 10k bets; payout variance | Resettlements are the public face of data quality. |
| Wallet reconciliation | … | Daily ledger-vs-processor breaks and $ variance (target 0) | If not zero, nothing else can be trusted. |
| Responsible-gaming outcomes | … | Limit adoption, exclusions honoured (100%), retention of limit-setters | Where “safety and retention move together” is proven or falsified. |
Simulated values come from one persona in one browser and are illustrative; they prove the instrumentation exists, not a forecast. They are never production metrics.
Findings from the v4 review and how they were resolved; each is covered by a named regression test.
| # | FINDING | RESOLUTION | TESTS |
|---|---|---|---|
| F1 | Malformed selections reached the wallet path | validateLeg() before eligibility and funds; coded refusals touch nothing. | |
| F2 | Missing accepted price bypassed odds check | Accepted price must be a finite number > 1 on every leg. | |
| F3 | Later exclusion could shorten an earlier one | Cooling-off and exclusion are monotonic; shortening is a logged no-op. | |
| F4 | Idempotency replayed unrelated transactions | Key stores a canonical payload fingerprint; mismatch → IDEMPOTENCY_CONFLICT. | |
| F5 | Lowering a limit failed reconciliation retroactively | Deposits record the limit in force; reconciliation checks against that. | |
| F6 | Correlated same-event legs undefined | Policy: one selection per event, enforced in placement and reconciliation. | |
| E1 | Deposits/withdrawals accepted empty keys | Non-empty idempotency key required on all money commands. | |
| E2 | Identity change could carry KYC and balance | Account isolation: REGISTER refused over an active account; SIGN_OUT discards all account-scoped state. | |
| E3 | Unknown event settlement threw | UNKNOWN_EVENT returned without exception; MARKET_SET validated too. | |
| E4 | Price moves on invalid selections threw | Selection, price range and settled-market checks; coded refusals. | |
| E5 | Invalid RG durations accepted | Positive finite integer durations only; limits and clock advances validated. |
What this prototype is not, and what production would add.
Not proven by these tests: concurrency (single-writer reducer; races are simulated by replay), persistence durability beyond a localStorage round-trip, vendor integrations (KYC, payments, odds are persona-encoded or hashed).