# 0004. The event log is the source of truth

- Status: Accepted
- Date: 2026-10-27

## Context

Orders change many times between opening and closing, often on devices that are offline. We need a full audit trail, safe retries and a simple way to merge work from several devices.

## Decision

Order and shift changes are recorded as immutable, append-only events with a ULID id generated on the device. Current state (an open order, a shift's totals) is a projection computed by replaying events with a pure reducer. The catalog (products, modifiers, categories, tax codes) is ordinary versioned CRUD data, not event-sourced.

## Consequences

- Stored events are never edited or deleted; corrections are new events (void, refund).
- Inserting by event id with `INSERT OR IGNORE` makes resending always safe.
- Replaying the same events always gives the same state, on any device or server.
- The envelope carries `deviceSeq` for gap detection and is designed so terminal-to-terminal or hub-to-hub sync needs no schema change later.