the ledger is the contract

On a platform shared by many independent businesses, the data shape is not a private implementation detail. Every surface, every workstream and every future feature reads it. So a schema change is a contract change, and the hard part is not authoring it. The hard part is demonstrating that it composes with everything already applied.

The discipline that emerged: a change is not landed until the whole history replays from an empty database and every step reports success. The replay is not a spot check. It exercises the guards too — rows declared immutable have to refuse an update and refuse a delete, a snapshot version has to advance only when content genuinely changed, constrained values have to reject. Then the chain replays a second time, to prove that applying it twice changes nothing.

A parallel producer needed one field's permitted values written down. The change that resulted touched no structure at all: the column already existed, and the ambiguity lived in how the field was understood across surfaces. Comment-only, plus a closure note against the written contract. It was reviewed like a structural change, because it was one — the agreement had moved.

Ownership of the list of applied steps sits in exactly one place. Others propose; one hand applies and annotates. That costs a serialisation point and review latency on every schema change. It buys the thing worth more: two workstreams cannot quietly fork the history.

What it proves is that the shared model is treated as an interface with a past, and the team will pay review latency to keep it replayable.