Audit card authorizations after account lock timestampRisk & Fraud

Task prompt

Hey, need a hand on something from risk. A member is disputing that we locked their joint card account, and it's made us nervous that our locks maybe didn't actually stop the cards the way they're supposed to. So I want to double check every joint account we've locked and see whether any of them were still able to put card charges through after the lock went on. Just so we're on the same page about scope: the only bucket I want dropped is the big automated account-sunset cleanup, so leave all of those out. Go by the reason we locked the account, not by how the account got closed later. Every other locked joint account counts, the whole family of risk and fraud locks (the ACH-returns, the counterparty ones, the fraud and investigation ones, and the rest), don't go hand-picking a few reasons and dropping the others. And when you go looking for spend that slipped through, I mean real charges where money actually got authorized, not the zero-dollar card checks. Here's what I need so I can act on it without redoing your work. First, the size of it. How many of those locked joint accounts had at least one card charge approved after we'd already locked them, how many such charges got through in total, and what's the total dollar amount that leaked out that way. Second, how concentrated it is. What's the worst single account, meaning the most leaked money sitting on any one account, and how many accounts had more than one charge slip through. Third, the cleanup list. Which cards were the ones still approving charges after the lock, so we can hard-block them, and in particular whether any of those cards never actually had the lock applied to them at all. And last, the part I really need. Locking the account is supposed to stop the cards, so why didn't it? Go read how our locking is actually supposed to work in the product docs, and check whether engineering already has a ticket open on the account-lock-to-card side of this, so I know the real root cause and I'm not flagging something they're already on. Then walk me through what's letting these charges through after a lock. Put the whole thing in one JSON object at the end so I can drop it straight into the tracker, using exactly these keys: leaked_dollars, offending_accounts, offending_auths, worst_account_dollars, accounts_multi_auth, cards_never_propagated, root_cause. The first six are plain numbers - dollars as a decimal, no currency symbols or thousands separators. root_cause is where you actually write to me: a few paragraphs walking me through why the lock didn't stop the cards, what the product docs say is supposed to happen, whether engineering already has a ticket on it, and how that lines up with the specific cards and charges you found leaking.