> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Operating Lerian Consignado — Dataprev

> The operational realities — the 24-hour auction window, the two reconciliation grains and why settlement is re-polled over a sliding window, per-tenant credential rotation, idempotency and redelivery, and the shared outbound rate limit.

Lerian Consignado — Dataprev runs against the operational realities of payroll lending: auctions that close on a clock, settlement that arrives late and without a terminal signal, credentials that rotate per institution, and a rail that tolerates only so many reads per second. It manages each under full per-tenant isolation.

## Auction window

***

Each worker loan request opens a **24-hour auction**. The discovery poller scatters only requests it has not seen before, so a request is auctioned once; the win-detection poller then tracks the submitted proposal until it reaches an accepted state.

## Reconciliation grain

***

Reconciliation runs at **two grains**:

* **Escrituração — per contract.** Each contract's installment record is captured once per (competência, employer) snapshot.
* **Repasse — per record.** Each settlement record has an append-only, immutable identifier and is **re-read on every tick** across a sliding window of competências.

The rail exposes **no deterministic final competência** and **no per-competência terminal status**, so the gateway treats the **presence of a settlement record as the settled predicate** and keeps re-polling the window to catch late D+2 settlements — terminations, arrears, and corrections that land after the first pass. D+2 is measured from the employer's payroll payment.

## Credentials and rotation

***

Credentials rotate **per tenant** through the control plane. Registering a certificate or OAuth secret upserts or rotates the stored value; the per-tenant Dataprev client is cached and refreshed on rotation, so a rotation takes effect without a redeploy. Secrets are never returned by any read.

## Idempotency and redelivery

***

Every record and settlement is keyed by its **immutable subject**, so at-least-once redelivery and restarts dedupe to a no-op downstream. Reprocessing the same record never double-counts a settlement.

## Rate limiting

***

A shared outbound limiter caps Dataprev reads at **25 requests per second**, split across the auction and reconciliation pollers, so neither can starve the other or exceed the rail's tolerance.