One fiscal core. A nation of possibilities.

01 / Channel intake and merchant identity

SMS is asynchronous, USSD is session-based, and chat apps support a richer conversation. Proposed channel adapters normalize these different inputs into one envelope: merchant identity, channel, language, external event ID and receipt time. A telecom delivery confirmation means that a message arrived, not that a fiscal sale was accepted.

Before processing a live sale, the production service must bind the sender to an authorized merchant and apply channel-specific consent, rate limits and replay protection. Language extraction can propose quantities and prices, but an approved catalog must determine tax treatment. Ambiguous amounts need clarification rather than an invented fiscal result.

02 / Core validation and authority handoff

MoTa Core separates parsing, arithmetic, persistence and authority submission. Validated items produce a tax-inclusive total using explicit rounding rules. The immutable sale ID links the original message to subsequent payment events and fiscal acknowledgements. A production CIS/VSDC adapter must map approved item codes and merchant credentials to the authority’s agreed contract.

A recorded sale, a successful payment and a fiscal acceptance are three different facts. Authority timeouts must remain pending until reconciled, and rejected records need an actionable reason. Ministry or central-bank reporting should consume authorized aggregates rather than unrestricted merchant messages. The current environment simulates these boundaries and does not submit to live authority systems.

03 / Complete totals, bounded exports

A 1,000-row response limit must never become a reporting limit. Counts, gross volume and VAT totals are calculated by database SQL functions over the full filtered register. The interface receives aggregates, not a sample that it sums locally. Filters and Africa/Kigali day boundaries must be identical for the displayed totals and exported records.

Large exports advance through bounded chunks using a stable cursor composed of timestamp and UUID. The UUID breaks ties when multiple sales share the same timestamp. For a reproducible production extract, define a cutoff and snapshot policy before paging. Failed downloads should report incompleteness instead of presenting a partial file as the full register.

SELECT COUNT(*), SUM(gross), SUM(vat)
FROM fiscal_transactions
WHERE created_at >= :day_start
  AND created_at < :day_end;

SELECT * FROM fiscal_transactions
WHERE (created_at, id) > (:cursor_time, :cursor_id)
  AND created_at < :export_cutoff
ORDER BY created_at, id
LIMIT :chunk_size;

04 / Latency, queues and weak connectivity

The engineering targets above describe internal processing, not guaranteed end-to-end delivery. Measure channel receipt, parsing, validation, storage, authority response and merchant notification separately. Production acceptance should use load tests and latency percentiles under realistic bursts, rather than a single average that hides slow transactions. No measured SLA is claimed here.

When coverage degrades, a proposed durable queue preserves accepted work and retries with the same event identity. Backoff, bounded retry budgets and a review queue prevent endless resubmission. An expired USSD session must not create duplicate sales. Reconnection triggers reconciliation, while offline fiscal issuance remains conditional on approved authority rules.