Most systems that owe you money store a number and update it. A credit arrives, the number goes up. A correction arrives, the number goes down. The number is the truth, and the history — if there is one — is a log written alongside it, for support staff to read when someone complains.

That design has a problem nobody likes to say out loud: the person running the system can change what you are owed, and the only record of the change is one they also control.

What ADCode does instead

Every event that moves money is a row. Rows are never updated and never deleted.

An ad you viewed writes an impression row with the exact amount.
A clawback writes a reversal row that points at the row it reverses.
An administrative correction writes an adjustment row carrying a reason and the identity of the administrator who made it.

Your balance is not stored as an authority. It is a fold over your rows — add them up and that is what you have. There is a cached copy for speed, and when the cache and the rows disagree, the rows win and the cache is rebuilt.

Why reversals instead of edits

If a credit turns out to be fraudulent, the obvious fix is to delete it. We do not, because a deleted row is indistinguishable from a row that never existed, and that is precisely the ambiguity a person disputing their balance cannot resolve.

Instead you see both rows: the original credit, and the reversal that took it back, with the reversal naming what it reversed. You can disagree with the reversal. You cannot be confused about whether it happened.

The part that makes it real

None of this matters if there is a back door. So there is no operation in the system that edits a ledger row — not in the API, not in the admin panel, not for anyone. The absence of the feature is the guarantee.

And because administrators can still *read* your history, every administrative read of another person's ledger writes its own audit row: who looked, at whom, when.

What you can check yourself

Open the earnings view in the editor, or the dashboard on the web. The rows you see are the rows the system has. The description you read — Ad from Vercel, 4.2s — is generated once, on the server, and shown identically to you and to us. There is no internal view with different numbers in it.