A balance needs domain bounds, not just an integer type. Reject impossible state at the write boundary before it reaches billing or risk systems.