Penny: dollar accounted for.

The problem. Payment code can pass every test and still lose money. Money bugs hide in the gaps tests never check: amounts stored as fractional numbers, tax rounded per line, a retry that charges a customer twice, a fee taken at two steps, a policy cap nobody coded. None of them crash anything. They surface weeks later as a reconciliation gap finance cannot explain, and engineers spend days tracing numbers by hand. We built ShopLedger, a small sample payments service, to show this plainly. Its bugs were seeded on purpose to mirror common real failures. On one simulated day of 500 orders, all five of its original tests passed while its books were off by $43,627.98 across four accounts. Not one of the seven rules in its written fee schedule was enforced. The solution. Penny is a custom mode inside IBM Bob that brings an auditor's method to that workflow. She works in five phases and stops after each one so a person reviews the evidence before she continues. 1. Map the money: every place money is created, moved, rounded or stored, with file and line. 2. Check the rules: Penny reads the written fee schedule and tests the code against every rule in it. At audit, 0 of 7 rules held. 3. Hunt: seven findings, each graded by its real dollar impact and tied to a rule, a file and a line. Penny then split each account's gap into the bugs that caused it, adding up to the cent with nothing left over. For example, the clearing account's $3,815.82 gap is $15,348.51 from retries minus $11,532.69 from a fee taken at the wrong step. 4. Prove, then fix: for every finding, Penny writes a test that fails for the right reason, shows the failure, makes the smallest fix, then reruns the whole suite. One finding, one proof, one fix. 5. Trial balance: rerun the same simulated day through the same reconciliation script. The result. Discrepancy before Penny: $43,627.98. Discrepancy after Penny: $0.00. The suite grew from 5 tests to 25, all passing. Every number comes from files in the repository, so anyone can clone it, run npm test and npm run simulate, and see the same result. Why it matters. The slow, error prone part of fixing money bugs is not writing the patch. It is proving what went wrong, where, and how much it cost. Penny turns that investigation into a repeatable, evidence first workflow that an engineer can run and a finance lead can read. Honest limits. The bugs in ShopLedger were seeded. Penny has not yet been run on a production codebase. The sample ledger lives in memory. Policy checks need a written fee schedule. Penny's rules currently point at this repository's paths. Our Bobcoin budget ran out during the final phase, so the trial balance was run from a script that pastes raw command output into the report and says so at the top.