One person, however many ways they reach you.
207 people and 377 endpoints in the live store. A phone number, an email address or a second phone all resolve onto one person, so the history you read is the history you wrote.
Identity is a decision, and the decision is recorded.
Two records that turn out to be the same human are merged, and the merge itself is an event rather than a deletion. The losing id keeps pointing at the winner, so a link written last year still lands on the right person today. Nothing is silently absorbed.
Illustration | the counts on this page are measured | 207 people, 377 endpoints, 2026-09-02
The number is the key
Endpoints are normalised on write, so the same phone typed four ways is one endpoint and one person rather than four half records.
A name is a claim, with a confidence
A name heard once on a noisy call is not the same fact as a name typed into a form. Confidence rides with it, and an agent speaks it only above a threshold.
Merging is reversible reading
A merged id is a pointer, never a hole. Every child row is re-parented, and a release gate asserts that zero rows reference a merged-away person.
That gate is one of the ones passing today. It is not a claim about care taken; it runs against the live store on every build, and its probe pins one specific real record that survived a merge and asserts it still carries every endpoint it had. The record is named in the probe and not on this page, because a customer of ours is not an illustration for our marketing.
One record, and today two stores.
The ledger is not yet the only place a customer fact lands. The store it is replacing took 67 writes in the last seven days. One record per human is true of everything the ledger holds and not yet true of everything we capture, and the gate covering it is failing on purpose until the second store stops taking writes.
measured 2026-09-02 | reproduce with ledgerctl.py shipstate