Ledger
The append-only, immutable record of every usage event. Totals and invoices are derived views computed from the ledger, not mutated counters.
A ledger is an append-only, immutable record of every usage event — each event becomes a new row that's never edited or deleted, rather than a running counter that gets incremented and can silently drift.
It matters because a mutable counter has no memory of how it got to its current value — if a number looks wrong, there's no way to trace back through what happened. An append-only ledger keeps the full history intact, so every total, invoice line and entitlement check is a computed view over real events, not a number you have to trust blindly.
In practice, correcting a mistake in a ledger means appending a new event that adjusts the record, not editing or deleting the original one — the original stays in place as a permanent part of the history, and the correction is itself an auditable event. Totals are recalculated by querying the ledger, not by patching a stored sum.
The common pitfall is treating the ledger as just a log file for debugging rather than as the actual source of billing truth — if invoices are generated from a separate running total that can fall out of sync with the ledger, the ledger stops doing its job. The append-only record has to be the thing every derived number is actually computed from, every time, not a backup copy of a separately maintained total.