Mersal The Append-Only Ledger, Explained
One rule, stated plainly
An append-only ledger obeys a single rule. Events are added. Events are never rewritten and never removed. Every action a firm takes becomes a new line, timestamped, attributed, and permanent. Nothing already written can be reached and altered later.
This is not the same as saving often, or keeping backups. A backup is a photograph of a moment you can still edit. An append-only record forbids the edit itself. The past is closed. Only the future accepts new entries.
The consequence follows directly. If you cannot change what was written, then what was written is what happened. The record stops being a story someone maintains and becomes a fact no one can quietly revise.
Corrections are new events, not erasures
The obvious objection: people make mistakes, and mistakes must be fixed. Append-only does not deny this. It changes the shape of the fix. You do not reach back and overwrite the error. You add a new event that supersedes it, and both remain visible, in order.
Consider a receipt issued against the wrong matter. In a mutable system, someone edits the field and the mistake vanishes, along with any evidence it occurred. In an append-only system, the original stands and a correcting entry is added above it. A reader sees the error, the correction, who made each, and when. The trail explains itself.
In Mersal this principle governs the operational core. The audit ledger is append-only, enforced at the database by triggers that reject any update or delete, for every role including administrators. Invoices freeze at issue; corrections happen by auditable reissue while the original stays on the record. A settled payment writes a receipt on its own serial, sealed against edit or deletion for anyone.
Why this changes audits, disputes and trust
Three things improve at once. An audit stops being an exercise in reconstruction, because the sequence was never disturbed; the auditor reads events rather than interviewing memories. A dispute narrows quickly, because the question of what was done, and when, has one answer visible to both sides. And internal trust rises, because no one, however senior, can revise the record to favour a version of events.
The property that protects the client also protects the partner. Neither can be accused of tampering with a record that structurally cannot be tampered with.
Append-only is a modest idea with a wide reach. It asks the firm to give up one convenience, the quiet edit, and returns something far larger: a record that argues for itself, in audits, in disputes, and in the ordinary work of trusting your own files. A ledger you cannot rewrite is the only ledger you never have to defend.
Matters, conflicts, VAT billing, sealed receipts and the docket, in one defensible system.