i
A history that cannot be rewritten without showing it
Every event is chained to the one before it, like links you cannot re-forge. Change an old link and every link after it stops matching.
Here is the part that matters. Your auditor writes down where the chain had reached last March and keeps that note themselves. Later they ask TRUSS: is my note still true? Someone with full control of our database could delete history and tidy up perfectly after themselves — and still fail that question, because they cannot reach into your auditor's pocket.