the ledger is append-only in substance

Settled entries are not edited except to keep their identifiers resolving. The rename round updated a settled entry in place, which no negative ontologies required and which the header did not authorise, so the ledger was neither append-only nor freely editable and the round's report recorded both readings without choosing. The header now states the rule; the wording is in the header rather than here so it is read before the entries are.

One case it does not cover, recorded rather than legislated: removing something from a settled entry for privacy — a name, a personal detail — is neither an identifier update nor a thing a later entry can fix by appending. It has not arisen; this ledger is deliberately exempt from the name lint. If it does arise, the header needs a third clause rather than an improvisation.