Split the loot once, and nobody gets shorted

What that night actually looks like

Someone types the total. Someone divides by the headcount. Someone remembers that four of those people were pugs and one is tax-exempt, and somebody has to be trusted to subtract the repair bill correctly.

Then the numbers are pasted into chat, and a week later nobody can reconstruct them when a member asks why their cut was smaller than their friend’s. The disputes that follow are rarely about theft. They are about arithmetic nobody wrote down.

So the whole design turns on one rule: show the split before any silver moves. The preview board is a full dry run — the same math, the same figures, the same per-member lines — and nothing is written until Confirm is pressed. The two lines above the card are there because they are the two things the card itself cannot say: who is about to be taxed, and what the people on the bench are about to get.

Casual raids go through this board too. They used to publish their split straight from the modal, which meant a mistyped gross was public before anyone could catch it.

Why the equation is a test and not a promise

The settlement module is pure: no Discord, no database, input in and result out. That is the whole reason it can be checked this way. A reconciles() predicate asserts the equation, and it is run against a table of hand-picked awkward cases — a tiny gross, an indivisible gross, an all-outsider raid, an all-member raid, mismatched rates, 88 million silver — and then against a 500-case deterministic pseudo-random sweep of gross, repair, rates, caller cut and roster shape.

There are two tax tallies, not one, and they are genuinely independent. Merchant tax is the guild’s take; regear tax funds replacement gear. Both default to 10%, both are charged on the same base, and both accumulate into their own bank. Rates are set in /settings → 💰 Economy → 💰 Edit rates.

Bank movements are recorded, not silently accumulated, so a bank total can be explained rather than merely trusted. If a total ever disagrees with the sum of its own movement history, /bank says so — that only ever means something moved a bank from outside the bot.

Taxed members, untaxed outsiders

Every signup carries a member-or-outsider flag. Members pay the merchant and regear tax and their net is credited to a balance the bot tracks. Outsiders take the same base share, untaxed, and are paid in game — the settled card labels their block "Outsider payouts (untaxed, pay in-game)" so nobody expects the bot to move it.

What decides the default is the tax mode, and the mode the raid stores is the one that counts. Changing the server setting next week cannot re-tax a raid that is already open. An officer can still flip one individual signup with a manual override on the manage panel, and that override wins over whatever the raid’s default was.

The settlement math never sees the mode. "Everyone" is just zero outsiders and "no one" is just zero members — both ordinary inputs it already handled — which is why adding three tax modes changed no arithmetic at all.

Guild-funded means the gross is untouched

The bonus is silver the guild adds to the pot, not silver taken out of the loot. The alternative — taking it out of the gross before splitting — is not a bonus at all, it is a redistribution of the loot, and it cannot pay anything on a raid that looted nothing.

That is why the reconciliation invariant grows a term on the left rather than a sixth bucket on the right, and why the raid’s recorded gross stays exactly what the loot sold for. A settle with 0 gross and a bonus is pure attendance pay, and it still reconciles.

Use it for attendance pay, a wipe consolation, or a fixed rate for content that has to be run but drops little. Outsiders never receive it — they have no balance to credit — and a roster with no taxed members produces a warning rather than a silent no-op, because a bonus that reaches nobody otherwise reads as the feature being broken.

The field is labelled "Bonus each — flat pay per member". The word "each" is in the label, not only the placeholder, because an officer typing a total into a per-head field is the one costly misreading available here, and it is silent.

What a member can check for themselves

/audit me is deliberately open to everyone. A member should be able to check and challenge their own history without asking an officer — which is what stops a dispute reaching the owner at all.

The view reconciles first: the cached balance against the sum of the member’s own history, printing matches when they agree. Shipped code cannot produce a mismatch — one writer, one call, one transaction — so a drift line never means rounding, it means something wrote outside the bot.

Then a per-reason breakdown, then the paged history, which always states its own window ("showing 10 of 42") because a list that truncates silently is how a hand-entered 8,000,000 became unreadable to the member who received it. Every line carries a date, a reason in the member’s own language, the officer who caused it where there was one, and a row id you can quote.

/audit member gives officers the same view for anyone. Regear claims are listed in every status, including ones that died half-finished — a claim stalled in collecting holds real silver and used to appear on no surface at all.

Undo is an entry, not a delete

/unsettle writes a compensating undo row for every settlement row, negative attendance rows for every point awarded, and compensating bank rows for both tax tallies — then drops the settlement snapshot and reopens the raid. A member who reads their own history sees the credit and the reversal, not a gap.

A participation bonus needs no special case in that reversal: it rides inside the same ledger delta, and its tax is inside the stored bank totals.

Recording a payout re-reads the balance inside the same transaction before writing the negative row, so two officers paying the same member at the same moment cannot both pass the check. A settle can only ever happen once per raid, enforced by a unique constraint and re-checked inside the transaction, because nothing in Discord’s interaction layer is double-click safe.

Whenever the board hides anything, its footer says what and how much. A written-off row also reappears by itself the moment that person’s balance moves again — the board hides only rows that are both marked and zero.