Receipts

Each record commits to the one before it (a hash chain) and is signed server-side with Wire Room's persistent @bbg/ledger Ed25519 key — so altering or removing any record breaks every record after it, and the signature proves it came from this key. This attests when you recorded something and that it hasn't changed — not that the claim is true. Anyone can re-verify a single receipt offline from its exported proof + the public key at /key.