Change History

Backed by an append-only PostgreSQL table (same trigger discipline as the payment ledger): events can be added, never edited or deleted — including every reveal of banking details.