Honest Simulation Seam
Platforms under development must simulate money movement before live credentials exist — and must never report fake money as real. Put simulation behind the same interface as the real gateway, with the simulated/real distinction explicit and enforced at the seam. An honest constraint that keeps a dangerous ambiguity impossible.
Problem
Platforms under development often need to simulate money movement before live payment credentials are available. The danger is accidentally reporting fake money as real money, especially when testing, demos, workers, analytics, and settlement reports share parts of the same pipeline.
Context
Use this pattern when a system needs to exercise dangerous or regulated behavior before production credentials, approvals, or integrations exist: payments, settlements, payouts, notifications, external writes, irreversible actions, or compliance workflows.
Forces
- Development needs realistic flows before the real external system is available.
- Operators and users must never confuse simulated effects with real effects.
- Tests and demos often reuse production-shaped data paths.
- Reports and workers may aggregate simulated records unless the seam is explicit.
- The system needs the same interface for fake and real behavior without erasing the difference.
Solution
Put simulation behind the same interface as the real gateway. Mark simulated transactions explicitly. Exclude simulated values from real revenue and settlement figures. Refuse to finalize simulated payments in production unless an explicit override is configured and recorded. Make the simulated/real distinction part of the data model and action boundary, not a comment or convention.
Consequences
Development remains possible. Financial truth remains protected. The platform can test the shape of money movement without claiming money moved. A dangerous ambiguity becomes structurally impossible instead of socially discouraged.
Failure Modes
- Simulated transactions flow into real revenue, settlement, or compliance reports.
- The fake gateway and real gateway have different interfaces, so tests exercise the wrong path.
- A production worker treats simulated records as finalizable real money.
- The simulated/real flag is optional, inferred, or stored only in logs.
- A demo dataset escapes into operational dashboards without visible simulation state.
Proof Points
fee logic need realistic development paths while protecting financial truth.
- Ampriot — reservations, payment flows, settlements, and
Full source pattern: 05-honest-simulation-seam.md.