Written once, read everywhere, edited never.

The rule

Capture is a one-way operation.

A journal row is written when the trade is entered on Saturday and is never subsequently altered in place. Every consumer downstream — the Weekly Summary, the EV Scorecard, the Branch Risk Engine, Capital Dynamics, the housed SDE and Regime engines, and each of the external labs — reads that row without the ability to change it. When something genuinely was recorded wrong, the repair is a new correction entry that references the original, not an edit that replaces it. The original stays. That is the whole rule, and almost everything the system claims about itself depends on it.

Why not just fix it

An overwrite destroys the one thing the error was evidence of.

The intuitive objection is strong: if a row is wrong, correcting it makes the data more accurate, and accuracy is the point. But a silently corrected row erases the fact that the error occurred, and error patterns are themselves diagnostic. A journal that quietly self-heals cannot tell you that MAE is systematically mis-recorded on trend trades, or that fee capture fails on Wednesdays, or that one branch's outcomes get revised more often than the others. The corrected value is more accurate about that trade and less honest about the process, and the process is what the review is examining.

The reproducibility argument

A read-only base is what makes a past conclusion re-checkable.

Every diagnostic the system produces is a function of the evidence available when it ran. If that evidence can change afterwards, no past conclusion can be reproduced — a gate decision from six weeks ago cannot be re-derived, because the rows it was computed from may no longer be the rows that existed then. Write-once makes the entire history replayable: any decision can be reconstructed from the state of the base at that moment, which is the difference between a system that can be audited and one that can only be trusted.

The QA rule that pairs with it

Never overwrite formulas to force a desired result.

The maintenance rules extend the same principle from data to the machinery: never overwrite formulas to force a desired result — fix upstream inputs or formulas properly. The two rules guard the same door from opposite sides. Write-once stops the record from being edited into agreement with a preferred story; the formula rule stops the calculation from being edited into agreement with a preferred number. A system where either erodes will keep producing outputs indefinitely, and none of them will mean anything, because the outputs will have become a function of what the operator wanted rather than of what happened.

• Blanks are used deliberately — a blank means no data, a zero means a measured zero. They are different claims.
• Corrections reference the original rather than replacing it, so the pair stays legible.
• Formula cells are treated as protected conceptually even where the file is not locked.

What it costs

The base accumulates noise, and that is accepted.

Write-once discipline produces a messier record than a self-healing one. Corrections sit alongside originals, superseded values remain visible, and reading a period's raw history requires knowing which entries were later amended. The system accepts this because the alternative optimizes the wrong thing — a tidy base is worth very little, while a base that can be interrogated about its own reliability is worth a great deal. Tidiness is a property of presentation; the rollups and summaries downstream provide it without the base having to.

The honesty inheritance

Everything above the journal inherits the journal's integrity, and nothing can restore it.

The evidence core sits at the bottom of every calculation chain in MARS, which gives it an asymmetric role: quality here propagates upward automatically, and its absence cannot be recovered anywhere above. No lab compensates for a corrupted journal. No amount of analytical sophistication in the EV Scorecard, the MAE/MFE Lab, or the SDE extracts a true expectancy from rows that were edited to look better. This is why the least glamorous module in the system carries the strictest rule, and why the rule is archival rather than merely careful.