What a ledger has to prove

Before we write a line of a ledger, we write down the invariants it has to hold. The code is checked against the invariants, not the other way round. Four of them come up on every system of record we build.

Conservation

Money is neither created nor destroyed. Every entry in the ledger balances: debits equal credits, account by account, transaction by transaction. If a report and a sum disagree, the report is wrong. The invariant is not negotiable.

Replay

The same events, applied in the same order, produce the same state. A ledger you cannot replay is a ledger you cannot audit, because nothing outside the live database can confirm the numbers it holds.

Idempotency

An instruction applied twice is applied once. Networks retry, queues redeliver, operators click a button twice. The ledger treats each instruction as identified once and refuses to post it twice.

Immutability

Corrections are new entries, never edits. A wrong posting is reversed by a second posting that references the first. An auditor should be able to reconstruct every decision, including the mistakes.

These are not aspirations. They are properties a system either has or does not, and each one can be tested in an afternoon with a script and a hostile operator. That is the standard we hold our own work to, and it is the standard a buyer should hold us to. Do not take the claim on faith. Ask to see the test.