Key Takeaways: Capstone

The one thing

You are the reason a number on a screen means what someone thinks it means. Nearly nobody downstream is in a position to check. That is not plumbing — it is custody, and the reconciliation is what taking it seriously looks like.

The acceptance criterion

For any calendar month, total net revenue computed from the gold layer equals total net revenue computed directly from the source database, to the cent — and every difference is explained by a documented, tested rule rather than discovered after the fact.

"To the cent" rules out close enough. A tolerance will absorb a real defect one day.

"Rather than discovered after the fact" is the harder clause: you must be able to predict the difference before running the comparison. Agreement can be a coincidence, or two errors cancelling.

The result

source, all rows                856,117     $24,102,447.18
  less R1 test orders           854,705     $24,061,239.18
  less R2 cancelled             811,798     $22,856,356.83
  less R3 gift cards            781,380     $21,945,202.00
  less R4 refunds               781,380     $20,430,983.06

As of 2026-12-01, which matters — see below.

📐 R1–R3 filter; R4 revalues. Only the second kind makes history mutable: November is not final until 1 March, fct_order_line needs a lookback window rather than append-only, and a reconciliation without an as-of date is not reproducible.

Three of the four rules belong to finance. They are accounting decisions a data team implements rather than makes.

Why the result is believable

🔎 The reconciliation closing is necessary and weak — it is a subtraction.

What verifies it is that two independent ratios agree:

781,380 lines / (6,480,000 / 12)     = 1.447x
$21,945,202 / ($182,000,000 / 12)    = 1.447x
$21,945,202 / 781,380                = $28.085
Chapter 1: $75.83 AOV / 2.70 lines   = $28.084

Two derivations, thirty-seven chapters apart, to four significant figures — and the self-check asserts it, so it is a test rather than an observation.

This is Chapter 36 Case Study 1's independence principle applied to a capstone: the check is not that gold matches the source, which is one derivation. It is that the result sits correctly against figures established before any of this was built.

Reconcile more than money

🔎 Four reconciliations, four blind spots:

Revenue and orders are the strong pair, because a defect must fool a sum and a count with the same rows.

For a platform with one reconciliation: add the row count. An hour of work, roughly double the coverage — and it is what falsified Case Study 1's first, wrong hypothesis.

Baselines and shapes

⚠️ A multiple is meaningless without its baseline, and the baseline is dropped when a figure is quoted. Black Friday is 6.28× the annual average day, 4.28× a November day, 7.89× November 1st — all true, one asserted. Applying 6.28 within November produces a Black Friday almost twice its real size, which is wrong and looks right.

🏭 Totals hide distributions. The month reconciled to the cent with Black Friday nearly doubled, because the total was pinned and the error moved lines between days. A real platform has the same blindness.

Assert shapes, not only totals: a peak on the right day · weekends lighter than weekdays · a ratio that matches an independently-established one.

Verify by rebuilding

The reconciliation is a claim about today's output. The rebuild is a claim about the whole system.

Expect it to fail. The failure is the deliverable.

📐 A reproducibility failure has no materiality threshold. Case Study 2's $741.18 is 0.0036%, and:

• The size is what the defect produced this month. The defect — "output depends on something other than declared input" — has no size.
• It invalidates four other checks. The rebuild, the replay, CI against a fixture, and the backfill procedure all assume the property that just failed.

Materiality is reasonable against an external source (Chapter 37's 50.2% irreducible) and not reasonable for a system compared against itself, where the correct difference is zero by construction.

Three causes, each latent over a year, none findable by any other control:

⚠️ A non-deterministic tie-break. A uniqueness test passes — the model produces one row per order every time, a different one. Only running twice detects it. And it had been fixed once before, at the sighting: the project-wide audit found 4 of 31 window functions without a unique tie-break. Grep the pattern, not the instance.

An undeclared input. A hand-made lookup table outside the project, so the "rebuild" resolved to production — which makes production an input to its own verification.

🏭 An impure model. A tax rate fetched at build time. The rebuild had reproduced three times before, because the rate had not changed — which is worse than never having run it, because it built confidence the model did not deserve. Found by a column-by-column diff, the only technique available when you do not know what the inputs are.

The durable fix is a check: purity.py bans network calls, now(), and reads outside the project. It found two more that had not yet produced a wrong number.

Nothing tests reproducibility except reproducing. The register tests data, CI tests code, monitors test the running system. The rebuild verifies that the platform is a function, and it costs $198.96.

What it costs and how long it takes

💸 $174.56 a night · $0.0181 per order · 0.0239% of the revenue it reports.

Publish slack, not completion time. 72 minutes normally, 19 on Black Friday — and show the peak-night arithmetic rather than asserting that it autoscales.

The quality register does not scale: 8% of the critical path normally, 13% on Black Friday — and it is the component nobody sized, because it costs $1.44 and is therefore invisible in a cost review.

And $0.0181 is the pipeline, not the platform. Chapter 33's full bill is $0.1526 per order. Quoting the first as the second is the same baseline error as Black Friday's, and it is flattering, which is why it happens.

The register at full scale

⚠️ 29 fires, 15 defects — 52%, and that is roughly right. "Not a defect" is not "false positive": nine freshness alerts correctly reported a late source and the correct action was wait; five volume alerts were Black Friday and revealed the band was wrong.

A register that fires only on real defects has bands too wide to measure anything. Too few alerts is as diagnostic as too many.

Making it someone else's

Six artifacts: a zero-to-running README tested on someone who has not seen it · a runbook · a catalog · a cost model · the reconciliation as a scheduled job · and a written "not done" list.

📐 The "not done" list is the most valuable handover artifact. Every item says why; the why is a decision, not a shortfall (label those differently); it is specific enough to act on; and it cites the chapter that justifies it. It prevents a new engineer spending three weeks on a deliberate choice.

🎓 The handover test is five questions a new engineer asks in week one — and they are almost word for word what an interviewer asks: how do I run it · which table should I use · is this number right · what happens if I break it · who do I ask. A platform that cannot answer the third has thirty-seven chapters of machinery and no conclusion.

What went wrong, and what to do differently

Four failed reconciliations, each a rule that existed and was not written down: a timezone · a missing filter · an accounting rule an engineer decided alone · and a correct rule pointed at the wrong month.

The fourth would have survived a code review, because the others are absences and a reviewer listing applicable rules finds absences. And the wrong version was the simpler one — it needed no join.

Twenty minutes versus three days, and the difference is whether the gap matched a known total exactly. When it does, the search is over.

One line in a pull-request template now catches the class: "does this model encode a rule that finance owns? If so, link the decision." Four yeses in a year; three came back changed, one came back confirmed — and the confirmation matters too, because an assumption became a decision.

🔎 And the one regret that generalizes: build the reconciliation first.

Written at the end it is an audit — every gap it finds has already been in production. Written in week one it is a specification, because answering what number, against what, differing by what rules, owned by whom is the entire design of the gold layer.

That is the pattern the whole book keeps arriving at: assertions before the model · decisions before the incident · classification at ingestion · the legacy-is-wrong policy before the shadow run. The same work costs an afternoon in advance and a quarter in arrears — and it is deferred because in advance it looks like process and in arrears it looks like firefighting.

If you take one working practice out of this book, take that one.

The code

code/capstone.py — a deterministic November 2026, four documented rules, the full reconciliation, and the daily shape including Black Friday. Thirty-eight self-checks, including that the two ratios agree with Chapter 1's independently-derived figures and that the money and the row counts reconcile separately. Run --self-check before reading §38.7.