Why Receipts Must Be Sealed

A receipt makes a claim: this money arrived, on this date, against this obligation. The claim is only worth what its permanence is worth. If the record can be changed after the fact, then it no longer states what happened. It states what someone last decided it should say.

Auditors understand this instinctively. The first question about any receipt is not what it shows but whether it could have been altered. A document that can be edited answers that question badly, no matter how accurate it is today. Accuracy without immutability is merely a current mood.

The remedy is not more care. It is removing the ability to edit at all. A receipt should be written once, at the moment money settles, and then sealed against every hand, including the hands that run the firm.

Two properties turn a receipt from an assertion into evidence. First, it is created by the event, not by a person. When a payment settles, the receipt is written automatically, so its existence is proof that settlement occurred. Second, it carries its own sequence. A receipt serial is not borrowed from the invoice; it is drawn from an independent series, so gaps and duplicates become detectable and the count of receipts stands on its own.

In Mersal, a settled card payment in the client portal writes a receipt with its own independent serial, sealed against edit or deletion for every role, and the payments ledger behind it is append-only. The token RCT-000148 means one thing forever.

Mistakes happen. A payment is misapplied, a currency is wrong, a client is credited twice. The instinct is to fix the receipt. That instinct is the whole problem. Overwriting destroys the only record of what was originally believed, and an audit trail with erasures in it is not a trail.

The disciplined path is reversal. The original receipt stays exactly as issued. A second entry reverses it, in full view, and a corrected entry follows. Anyone reading the ledger later can reconstruct not just the right answer but the sequence of belief that led to it.

• The original is preserved, timestamped and sealed.
• The reversal is a new, dated entry, not a deletion.
• The correction is a new receipt with its own serial.

This is why an append-only ledger changes the audit conversation. There is nothing to reconcile between what the record says now and what it said before, because the record never said anything else.