0004. The event log is the source of truth

• Status: Accepted
• Date: 2026-10-27

Context

Orders change many times between opening and closing, often on devices that are offline. We need a full audit trail, safe retries and a simple way to merge work from several devices.

Decision

Order and shift changes are recorded as immutable, append-only events with a ULID id generated on the device. Current state (an open order, a shift’s totals) is a projection computed by replaying events with a pure reducer. The catalog (products, modifiers, categories, tax codes) is ordinary versioned CRUD data, not event-sourced.

Consequences

• Stored events are never edited or deleted; corrections are new events (void, refund).
• Inserting by event id with INSERT OR IGNORE makes resending always safe.
• Replaying the same events always gives the same state, on any device or server.
• The envelope carries deviceSeq for gap detection and is designed so terminal-to-terminal or hub-to-hub sync needs no schema change later.