Audit log

Every entry commits to the hash of the one before it. Altering or deleting a row breaks verification from that point onward, so history cannot be quietly rewritten — including by someone with database access.